## Summary With `FF_USE_GIT_NATIVE_CLONE: true` and `GIT_STRATEGY: clone`, the runner builds its clone command from `build.GitInfo.Ref` — for merged results pipelines, `refs/merge-requests/<iid>/merge`. That ref is mutable: GitLab rewrites it via `MergeRequests::MergeabilityCheckService` whenever `merge_status` is invalidated, which includes any time the **target** branch advances. The `git init` + `git fetch` path does not have this problem, because it uses `build.GitInfo.Refspecs`, whose first entry is `+<sha>:refs/pipelines/<pipeline id>` — a raw-SHA want, served thanks to `uploadpack.allowAnySHA1InWant`, and guaranteed resolvable for the pipeline's lifetime by the persistent pipeline ref. `GitInfo.Refspecs` is referenced exactly once in `shells/abstract.go`, inside `writeRefspecFetchCmd`. The native clone path never reads it. The net effect is that enabling native clone silently reverts the fix introduced in GitLab 12.4 by persistent pipeline refs (gitlab-org/gitlab!17043). The server side behaves correctly throughout — `refs/pipelines/<id>` is created and still present at the moment of failure — the runner just doesn't ask for it. This only manifests when the target branch moves *without* the source branch moving. Pushing to the source branch also triggers the rewrite, but auto-cancel-redundant-pipelines usually cancels the affected pipeline before any job notices, which is likely why this hasn't been reported: the common case is masked, and the uncommon case needs a busy shared target branch plus pipelines long enough to straddle a merge. Disclaimer: root cause, bug report, potential fix, and workaround all assisted by Claude. ## Steps to reproduce Prerequisites: - Merged results pipelines enabled on the project (Settings > Merge requests). - A helper image with Git >= 2.49, otherwise `IfGitVersionIsAtLeast(gitMinVersionCloneWithRef)` routes back to the refspec fetch path and the bug is invisible. - A pipeline with enough duration (or enough queueing) that some jobs clone at least a minute or two after the pipeline was created. Then: 1. Open MR A against `main`. Let its merged results pipeline start. 2. While that pipeline is running, commit anything else into `main`. 3. Watch the jobs in MR A's pipeline that reach the `Getting source` step *after* step 2. Jobs that cloned before the target advanced succeed. Jobs that cloned after it fail. No push to MR A's source branch is involved, so nothing is cancelled and the pipeline is still the latest pipeline for the MR. I reproduced this deliberately by waiting until an unrelated MR was about halfway through a merge train, then starting a pipeline on my own branch. The first few jobs passed, the other MR merged, then any job that was still `pending` in my MR pipeline fails when it gets to the clone step. Same pipeline, same SHA, same config, same runner fleet — the only variable across the pass/fail boundary was what time each job reached the clone step. <details> <summary> .gitlab-ci.yml </summary> ```yml # The essentials are just: variables: FF_USE_GIT_NATIVE_CLONE: "true" GIT_STRATEGY: clone GIT_DEPTH: "20" some-job: stage: build script: - echo ok ``` </details> ## Actual behavior The clone **succeeds**, and it succeeds against the wrong commit: `--revision refs/merge-requests/<iid>/merge` resolves server-side at clone time, so the runner fetches whatever the merge ref points at *now* — the newly recomputed merge commit against the advanced target. The failure then surfaces one step later, in `writeCheckoutCmd`, which correctly uses `build.GitInfo.Sha`: ``` git checkout -f -q <pipeline sha> fatal: unable to read tree <pipeline sha> ``` With `GIT_DEPTH` set, the shallow slice is cut around the new merge commit, so the pipeline's SHA is not present in the object database at all. Two consequences worth separating: 1. The job fails, which is at least loud. 2. Before it fails, the runner has materialized a fully populated worktree at a commit that is **not** the one the pipeline is for. Any tooling that runs before checkout, or that tolerates checkout failure, is operating on the wrong tree. `refs/pipelines/<pipeline id>` is still present and still resolves to the correct SHA at the moment of failure — verifiable with `git ls-remote origin 'refs/pipelines/*'`. ## Expected behavior Native clone should be as robust as the fetch path against merge-ref rewrites: the job checks out the pipeline's SHA, or fails in a way that reflects a genuine problem, not a routine target-branch merge. `git clone --revision` accepts a fully qualified reference *or a raw commit hash* (see the upstream option's documentation, and gitlab-org/git!207), so passing `build.GitInfo.Sha` is a direct substitution. The SHA is already available in the same struct and is already used three lines later by `writeCheckoutCmd`. ## Relevant logs and/or screenshots Here's some job logs with `GIT_TRACE2` enabled. The `--reference-if-able /git-reference/somerepo.git` bits are due to using a reference repo mounted readonly in the job containers, they shouldn't be relevant to the issue. <details> <summary> job log </summary> ```sh Getting source from Git repository 00:34 00:30:13.870493 common-init.c:57 version 2.54.0 00:30:13.870507 common-init.c:58 start git config --global http.https://gitlab.example.com.sslCAInfo /builds/somerepo.tmp/CI_SERVER_TLS_CA_FILE 00:30:13.870567 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:13.870612 git.c:503 cmd_name config (config) 00:30:13.873352 git.c:783 exit elapsed:0.003015 code:0 00:30:13.873359 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.003023 code:0 00:30:14.186678 common-init.c:57 version 2.54.0 00:30:14.186691 common-init.c:58 start git config --global --add safe.directory /builds/somerepo 00:30:14.186749 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.186781 git.c:503 cmd_name config (config) 00:30:14.187037 git.c:783 exit elapsed:0.000485 code:0 00:30:14.187044 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000493 code:0 00:30:14.187958 common-init.c:57 version 2.54.0 00:30:14.187969 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config init.defaultBranch none 00:30:14.188030 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.188069 git.c:503 cmd_name config (config) 00:30:14.188225 git.c:783 exit elapsed:0.000400 code:0 00:30:14.188231 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000406 code:0 00:30:14.189213 common-init.c:57 version 2.54.0 00:30:14.189226 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config fetch.recurseSubmodules false 00:30:14.189291 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.189331 git.c:503 cmd_name config (config) 00:30:14.189538 git.c:783 exit elapsed:0.000495 code:0 00:30:14.189546 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000504 code:0 00:30:14.190477 common-init.c:57 version 2.54.0 00:30:14.190490 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config credential.interactive never 00:30:14.190545 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.190577 git.c:503 cmd_name config (config) 00:30:14.190789 git.c:783 exit elapsed:0.000457 code:0 00:30:14.190796 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000465 code:0 00:30:14.191681 common-init.c:57 version 2.54.0 00:30:14.191692 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config gc.autoDetach false 00:30:14.191748 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.191785 git.c:503 cmd_name config (config) 00:30:14.192008 git.c:783 exit elapsed:0.000485 code:0 00:30:14.192015 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000492 code:0 00:30:14.194211 common-init.c:57 version 2.54.0 00:30:14.194224 common-init.c:58 start git config -f /builds/somerepo.tmp/.gitlab-runner.ext.conf http.extraHeader 'X-Gitaly-Correlation-ID: 01KYK2225NVQBE0YG447CKYDR5' 00:30:14.194273 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.194305 git.c:503 cmd_name config (config) 00:30:14.194466 git.c:783 exit elapsed:0.000388 code:0 00:30:14.194474 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000397 code:0 Gitaly correlation ID: 01KYK2225NVQBE0YG447CKYDR5 00:30:14.195396 common-init.c:57 version 2.54.0 00:30:14.195414 common-init.c:58 start git config --file /builds/somerepo.tmp/.gitlab-runner.ext.conf --replace-all url.https://gitlab-ci-token:[MASKED]@gitlab.example.com/somerepo.git.insteadOf https://gitlab.example.com/somerepo.git '^https://gitlab\.example\.com/somerepo\.git$' 00:30:14.195471 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.195506 git.c:503 cmd_name config (config) 00:30:14.195766 git.c:783 exit elapsed:0.000506 code:0 00:30:14.195773 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000513 code:0 00:30:14.196775 common-init.c:57 version 2.54.0 00:30:14.196786 common-init.c:58 start git config --file /builds/somerepo.tmp/.gitlab-runner.ext.conf --replace-all url.https://gitlab-ci-token:[MASKED]@gitlab.example.com.insteadOf https://gitlab.example.com '^https://gitlab\.example\.com$' 00:30:14.196849 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.196885 git.c:503 cmd_name config (config) 00:30:14.197127 git.c:783 exit elapsed:0.000480 code:0 00:30:14.197134 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000488 code:0 00:30:14.198095 common-init.c:57 version 2.54.0 00:30:14.198105 common-init.c:58 start git config --file /builds/somerepo.tmp/git-template/config --replace-all include.path /builds/somerepo.tmp/.gitlab-runner.ext.conf '\.gitlab-runner\.ext\.conf$' 00:30:14.198180 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.198216 git.c:503 cmd_name config (config) 00:30:14.198430 git.c:783 exit elapsed:0.000473 code:0 00:30:14.198436 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000480 code:0 00:30:14.201392 common-init.c:57 version 2.54.0 00:30:14.201401 common-init.c:58 start git version 00:30:14.201462 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- bash <- dumb-init 00:30:14.201487 git.c:503 cmd_name version (version) 00:30:14.201503 git.c:783 exit elapsed:0.000235 code:0 00:30:14.201508 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000241 code:0 Git version at least "2.49" Cloning repository for refs/merge-requests/6903/merge... 00:30:14.205412 common-init.c:57 version 2.54.0 00:30:14.205428 common-init.c:58 start git -c 'http.userAgent=gitlab-runner 19.0.1 linux/amd64' clone --no-checkout https://gitlab.example.com/somerepo.git /builds/somerepo --template /builds/somerepo.tmp/git-template --revision refs/merge-requests/6903/merge --reference-if-able /git-reference/somerepo.git 00:30:14.205477 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:14.205510 git.c:503 cmd_name clone (clone) 00:30:14.205651 repository.c:262 worktree /builds/somerepo Cloning into '/builds/somerepo'... info: Could not add alternate for '/git-reference/somerepo.git': path '/git-reference/somerepo.git' does not exist 00:30:14.209276 run-command.c:739 child_start[0] git remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 00:30:14.210084 common-init.c:57 version 2.54.0 00:30:14.210097 common-init.c:58 start /usr/libexec/git-core/git remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 00:30:14.210195 compat/linux/procinfo.c:170 cmd_ancestry git <- bash <- bash <- dumb-init 00:30:14.210301 git.c:803 cmd_name _run_dashed_ (clone/_run_dashed_) 00:30:14.210314 run-command.c:739 child_start[0] git-remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 00:30:14.212312 common-init.c:57 version 2.54.0 00:30:14.212325 common-init.c:58 start /usr/libexec/git-core/git-remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 00:30:14.212406 compat/linux/procinfo.c:170 cmd_ancestry git <- git <- bash <- bash <- dumb-init 00:30:14.212454 repository.c:262 worktree / 00:30:14.212483 remote-curl.c:1584 cmd_name remote-curl (clone/_run_dashed_/remote-curl) 00:30:14.481682 run-command.c:739 child_start[1] git index-pack --stdin --fix-thin '--keep=fetch-pack 49 on runner-xxxxxxxxx-project-23-concurrent-0' --check-self-contained-and-connected 00:30:14.482793 common-init.c:57 version 2.54.0 00:30:14.482803 common-init.c:58 start /usr/libexec/git-core/git index-pack --stdin --fix-thin '--keep=fetch-pack 49 on runner-xxxxxxxxx-project-23-concurrent-0' --check-self-contained-and-connected 00:30:14.482875 compat/linux/procinfo.c:170 cmd_ancestry git <- bash <- bash <- dumb-init 00:30:14.482943 repository.c:262 worktree / 00:30:14.483035 git.c:503 cmd_name index-pack (clone/index-pack) 00:30:40.528139 common-main.c:12 exit elapsed:26.315927 code:0 00:30:40.528788 trace2/tr2_tgt_normal.c:128 atexit elapsed:26.316578 code:0 00:30:40.529225 run-command.c:995 child_exit[0] pid:51 code:0 elapsed:26.318909 00:30:40.529249 git.c:825 exit elapsed:26.319274 code:0 00:30:40.529257 trace2/tr2_tgt_normal.c:128 atexit elapsed:26.319280 code:0 00:30:47.307422 git.c:783 exit elapsed:32.824752 code:0 00:30:47.307439 trace2/tr2_tgt_normal.c:372 counter fsync/hardware-flush value:3 00:30:47.307443 trace2/tr2_tgt_normal.c:128 atexit elapsed:32.824771 code:0 00:30:47.308435 run-command.c:995 child_exit[1] pid:53 code:0 elapsed:32.826752 00:30:47.308604 run-command.c:995 child_exit[0] pid:50 code:0 elapsed:33.099331 00:30:47.309196 git.c:783 exit elapsed:33.103894 code:0 00:30:47.309207 trace2/tr2_tgt_normal.c:128 atexit elapsed:33.103905 code:0 Checking out 524b74d5 as detached HEAD (ref is refs/merge-requests/6903/merge)... 00:30:47.310570 common-init.c:57 version 2.54.0 00:30:47.310584 common-init.c:58 start git -c submodule.recurse=false checkout -f -q 524b74d57328397416ae84bdc5dfa6b2c1d5914f 00:30:47.310644 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 00:30:47.310722 repository.c:262 worktree /builds/somerepo 00:30:47.310819 git.c:503 cmd_name checkout (checkout) 00:30:47.311125 usage.c:73 error unable to read tree (524b74d57328397416ae84bdc5dfa6b2c1d5914f) fatal: unable to read tree (524b74d57328397416ae84bdc5dfa6b2c1d5914f) 00:30:47.311134 usage.c:87 exit elapsed:0.000712 code:128 00:30:47.311138 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000717 code:128 ``` </details> <details> <summary> succeeding job from the same pipeline (cloned before the target advanced) </summary> ```sh Running on runner-xxxxxxxxx-project-23-concurrent-0 via 0ae2bd022834... Getting source from Git repository 01:15 23:57:22.751175 common-init.c:57 version 2.54.0 23:57:22.751191 common-init.c:58 start git config --global http.https://gitlab.example.com.sslCAInfo /builds/somerepo.tmp/CI_SERVER_TLS_CA_FILE 23:57:22.751266 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:22.751315 git.c:503 cmd_name config (config) 23:57:22.754065 git.c:783 exit elapsed:0.003091 code:0 23:57:22.754077 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.003105 code:0 23:57:23.223313 common-init.c:57 version 2.54.0 23:57:23.223324 common-init.c:58 start git config --global --add safe.directory /builds/somerepo 23:57:23.223382 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.223415 git.c:503 cmd_name config (config) 23:57:23.223688 git.c:783 exit elapsed:0.000502 code:0 23:57:23.223694 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000509 code:0 23:57:23.224684 common-init.c:57 version 2.54.0 23:57:23.224698 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config init.defaultBranch none 23:57:23.224761 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.224800 git.c:503 cmd_name config (config) 23:57:23.224943 git.c:783 exit elapsed:0.000413 code:0 23:57:23.224950 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000420 code:0 23:57:23.225790 common-init.c:57 version 2.54.0 23:57:23.225800 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config fetch.recurseSubmodules false 23:57:23.225846 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.225879 git.c:503 cmd_name config (config) 23:57:23.226059 git.c:783 exit elapsed:0.000374 code:0 23:57:23.226065 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000381 code:0 23:57:23.226990 common-init.c:57 version 2.54.0 23:57:23.226999 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config credential.interactive never 23:57:23.227055 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.227094 git.c:503 cmd_name config (config) 23:57:23.227320 git.c:783 exit elapsed:0.000466 code:0 23:57:23.227327 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000474 code:0 23:57:23.228283 common-init.c:57 version 2.54.0 23:57:23.228293 common-init.c:58 start git config -f /builds/somerepo.tmp/git-template/config gc.autoDetach false 23:57:23.228346 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.228387 git.c:503 cmd_name config (config) 23:57:23.228605 git.c:783 exit elapsed:0.000463 code:0 23:57:23.228611 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000471 code:0 23:57:23.230890 common-init.c:57 version 2.54.0 23:57:23.230901 common-init.c:58 start git config -f /builds/somerepo.tmp/.gitlab-runner.ext.conf http.extraHeader 'X-Gitaly-Correlation-ID: 01KYK05WR0PYMD5PDF7X0WWB49' 23:57:23.230957 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.230995 git.c:503 cmd_name config (config) 23:57:23.231167 git.c:783 exit elapsed:0.000414 code:0 23:57:23.231174 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000422 code:0 Gitaly correlation ID: 01KYK05WR0PYMD5PDF7X0WWB49 23:57:23.232238 common-init.c:57 version 2.54.0 23:57:23.232255 common-init.c:58 start git config --file /builds/somerepo.tmp/.gitlab-runner.ext.conf --replace-all url.https://gitlab-ci-token:[MASKED]@gitlab.example.com/somerepo.git.insteadOf https://gitlab.example.com/somerepo.git '^https://gitlab\.example\.com/somerepo\.git$' 23:57:23.232318 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.232358 git.c:503 cmd_name config (config) 23:57:23.232594 git.c:783 exit elapsed:0.000518 code:0 23:57:23.232600 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000524 code:0 23:57:23.233536 common-init.c:57 version 2.54.0 23:57:23.233550 common-init.c:58 start git config --file /builds/somerepo.tmp/.gitlab-runner.ext.conf --replace-all url.https://gitlab-ci-token:[MASKED]@gitlab.example.com.insteadOf https://gitlab.example.com '^https://gitlab\.example\.com$' 23:57:23.233608 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.233643 git.c:503 cmd_name config (config) 23:57:23.233858 git.c:783 exit elapsed:0.000481 code:0 23:57:23.233864 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000488 code:0 23:57:23.234678 common-init.c:57 version 2.54.0 23:57:23.234690 common-init.c:58 start git config --file /builds/somerepo.tmp/git-template/config --replace-all include.path /builds/somerepo.tmp/.gitlab-runner.ext.conf '\.gitlab-runner\.ext\.conf$' 23:57:23.234742 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.234776 git.c:503 cmd_name config (config) 23:57:23.234986 git.c:783 exit elapsed:0.000403 code:0 23:57:23.234992 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000410 code:0 23:57:23.237695 common-init.c:57 version 2.54.0 23:57:23.237712 common-init.c:58 start git version 23:57:23.237783 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- bash <- dumb-init 23:57:23.237809 git.c:503 cmd_name version (version) 23:57:23.237826 git.c:783 exit elapsed:0.000266 code:0 23:57:23.237831 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.000272 code:0 Git version at least "2.49" Cloning repository for refs/merge-requests/6903/merge... 23:57:23.241501 common-init.c:57 version 2.54.0 23:57:23.241515 common-init.c:58 start git -c 'http.userAgent=gitlab-runner 19.0.1 linux/amd64' clone --no-checkout https://gitlab.example.com/somerepo.git /builds/somerepo --template /builds/somerepo.tmp/git-template --revision refs/merge-requests/6903/merge --reference-if-able /git-reference/somerepo.git 23:57:23.241575 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:57:23.241604 git.c:503 cmd_name clone (clone) 23:57:23.241751 repository.c:262 worktree /builds/somerepo Cloning into '/builds/somerepo'... info: Could not add alternate for '/git-reference/somerepo.git': path '/git-reference/somerepo.git' does not exist 23:57:23.246442 run-command.c:739 child_start[0] git remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 23:57:23.247262 common-init.c:57 version 2.54.0 23:57:23.247277 common-init.c:58 start /usr/libexec/git-core/git remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 23:57:23.247340 compat/linux/procinfo.c:170 cmd_ancestry git <- bash <- bash <- dumb-init 23:57:23.247438 git.c:803 cmd_name _run_dashed_ (clone/_run_dashed_) 23:57:23.247451 run-command.c:739 child_start[0] git-remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 23:57:23.250214 common-init.c:57 version 2.54.0 23:57:23.250226 common-init.c:58 start /usr/libexec/git-core/git-remote-https origin 'https://gitlab-ci-token:<REDACTED>@gitlab.example.com/somerepo.git' 23:57:23.250320 compat/linux/procinfo.c:170 cmd_ancestry git <- git <- bash <- bash <- dumb-init 23:57:23.250371 repository.c:262 worktree / 23:57:23.250394 remote-curl.c:1584 cmd_name remote-curl (clone/_run_dashed_/remote-curl) 23:57:35.036455 run-command.c:739 child_start[1] git index-pack --stdin --fix-thin '--keep=fetch-pack 49 on runner-xxxxxxxxx-project-23-concurrent-0' --check-self-contained-and-connected 23:57:35.037485 common-init.c:57 version 2.54.0 23:57:35.037496 common-init.c:58 start /usr/libexec/git-core/git index-pack --stdin --fix-thin '--keep=fetch-pack 49 on runner-xxxxxxxxx-project-23-concurrent-0' --check-self-contained-and-connected 23:57:35.037570 compat/linux/procinfo.c:170 cmd_ancestry git <- bash <- bash <- dumb-init 23:57:35.037640 repository.c:262 worktree / 23:57:35.037737 git.c:503 cmd_name index-pack (clone/index-pack) 23:58:05.391938 common-main.c:12 exit elapsed:42.141842 code:0 23:58:05.392697 trace2/tr2_tgt_normal.c:128 atexit elapsed:42.142605 code:0 23:58:05.393139 run-command.c:995 child_exit[0] pid:51 code:0 elapsed:42.145683 23:58:05.393365 git.c:825 exit elapsed:42.146234 code:0 23:58:05.393377 trace2/tr2_tgt_normal.c:128 atexit elapsed:42.146244 code:0 23:58:12.643493 git.c:783 exit elapsed:37.606171 code:0 23:58:12.643511 trace2/tr2_tgt_normal.c:372 counter fsync/hardware-flush value:3 23:58:12.643515 trace2/tr2_tgt_normal.c:128 atexit elapsed:37.606192 code:0 23:58:12.644760 run-command.c:995 child_exit[1] pid:53 code:0 elapsed:37.608300 23:58:12.644941 run-command.c:995 child_exit[0] pid:50 code:0 elapsed:49.398502 23:58:12.645474 git.c:783 exit elapsed:49.404081 code:0 23:58:12.645484 trace2/tr2_tgt_normal.c:128 atexit elapsed:49.404090 code:0 Checking out 524b74d5 as detached HEAD (ref is refs/merge-requests/6903/merge)... 23:58:12.646725 common-init.c:57 version 2.54.0 23:58:12.646737 common-init.c:58 start git -c submodule.recurse=false checkout -f -q 524b74d57328397416ae84bdc5dfa6b2c1d5914f 23:58:12.646797 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:58:12.646866 repository.c:262 worktree /builds/somerepo 23:58:12.646952 git.c:503 cmd_name checkout (checkout) 23:58:12.647296 builtin/checkout.c:1170 cmd_mode branch 23:58:12.701578 run-command.c:739 child_start[0] 'git-lfs filter-process' 23:58:16.174962 run-command.c:739 child_start[1] .git/hooks/post-checkout 524b74d57328397416ae84bdc5dfa6b2c1d5914f 524b74d57328397416ae84bdc5dfa6b2c1d5914f 1 23:58:16.179574 common-init.c:57 version 2.54.0 23:58:16.179584 common-init.c:58 start git lfs post-checkout 524b74d57328397416ae84bdc5dfa6b2c1d5914f 524b74d57328397416ae84bdc5dfa6b2c1d5914f 1 23:58:16.179704 compat/linux/procinfo.c:170 cmd_ancestry post-checkout <- git <- bash <- bash <- dumb-init 23:58:16.179848 git.c:803 cmd_name _run_dashed_ (checkout/_run_dashed_) 23:58:16.179858 run-command.c:739 child_start[0] git-lfs post-checkout 524b74d57328397416ae84bdc5dfa6b2c1d5914f 524b74d57328397416ae84bdc5dfa6b2c1d5914f 1 23:58:16.282973 run-command.c:995 child_exit[0] pid:90 code:0 elapsed:0.103111 23:58:16.282988 git.c:825 exit elapsed:0.103572 code:0 23:58:16.282995 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.103578 code:0 23:58:16.283230 run-command.c:995 child_exit[1] pid:88 code:0 elapsed:0.108263 23:58:16.283268 git.c:783 exit elapsed:3.636674 code:0 23:58:16.284468 run-command.c:995 child_exit[0] pid:59 code:0 elapsed:3.582888 23:58:16.284486 trace2/tr2_tgt_normal.c:128 atexit elapsed:3.637890 code:0 23:58:16.294329 common-init.c:57 version 2.54.0 23:58:16.294338 common-init.c:58 start git clean -ffdx 23:58:16.294395 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:58:16.294458 repository.c:262 worktree /builds/somerepo 23:58:16.294544 git.c:503 cmd_name clean (clean) 23:58:16.340569 git.c:783 exit elapsed:0.046355 code:0 23:58:16.340581 trace2/tr2_tgt_normal.c:128 atexit elapsed:0.046368 code:0 23:58:16.350853 common-init.c:57 version 2.54.0 23:58:16.350862 common-init.c:58 start git lfs pull 23:58:16.350908 compat/linux/procinfo.c:170 cmd_ancestry bash <- bash <- dumb-init 23:58:16.351035 git.c:803 cmd_name _run_dashed_ (_run_dashed_) 23:58:16.351048 run-command.c:739 child_start[0] git-lfs pull 23:58:36.691835 run-command.c:995 child_exit[0] pid:130 code:0 elapsed:20.340783 23:58:36.691859 git.c:825 exit elapsed:20.341140 code:0 23:58:36.691867 trace2/tr2_tgt_normal.c:128 atexit elapsed:20.341146 code:0 ``` </details> ## Environment description Self-managed GitLab EE 19.0.1. Docker executor. Merged results pipelines enabled; auto-cancel redundant pipelines at the default. `ci_skip_persistent_ref_create` is **off**, so persistent pipeline refs are being created normally. Monorepo with a shared `main` that several teams land merges on throughout the day, which is what makes the race routine rather than theoretical. <details> <summary> config.toml contents </summary> ```toml [[runners]] name = "example-runners" request_concurrency = 5 url = "https://gitlab.example.com" id = 23 token = "blah" token_obtained_at = 2026-07-28T12:12:23Z token_expires_at = 0001-01-01T00:00:00Z executor = "docker-autoscaler" [runners.autoscaler] plugin = "aws:1.2.0" capacity_per_instance = 4 max_use_count = 100 max_instances = 40 [runners.autoscaler.plugin_config] name = "example-runners" profile = "default" config_file = "/etc/gitlab-runner/.aws/config" credentials_file = "/etc/gitlab-runner/.aws/credentials" region = "us-west-2" [runners.autoscaler.connector_config] username = "ubuntu" use_external_addr = false key_path = "/etc/gitlab-runner/keypair.pem" use_static_credentials = false [[runners.autoscaler.policy]] periods = ["* * * * *"] idle_count = 0 idle_time = "20m0s" [runners.docker] image = "gitlab.example.com/somerepo/aws-git.runner:2023-11-29" helper_image = "registry.gitlab.com/gitlab-org/gitlab-runner/gitlab-runner-helper:alpine-edge-x86_64-v${CI_RUNNER_VERSION}" privileged = false services_privileged = true allowed_privileged_services = ["docker.io/library/docker:*-dind-rootless", "docker.io/library/docker:dind-rootless", "docker:*-dind-rootless", "docker:dind-rootless"] volumes = ["/certs/client", "/cache", "/opt/git-reference:/git-reference:ro"] volume_keep = false tls_verify = false disable_cache = false [runners.feature_flags] FF_NETWORK_PER_BUILD = true [runners.cache] Type = "s3" Shared = true [runners.cache.s3] ServerAddress = "s3.amazonaws.com" BucketName = "example-runners-runner-cache" BucketLocation = "us-west-2" RoleARN = "arn:aws:iam::111111111111:role/example-runners-role" Insecure = false ``` </details> ### Used GitLab Runner version ``` gitlab-runner 19.0.1 ``` Helper image is Linux-flavored 19.0.x, so Git is >= 2.49 and the native clone path is taken. ## Possible fixes In `shells/abstract.go`, `writeCloneRevisionCmd` (line ~989 on `main`, ~946 on `v19.0.1`): ```go if strings.HasPrefix(build.GitInfo.Ref, "refs/") { cloneArgs = append(cloneArgs, "--revision", build.GitInfo.Ref) } else if build.GitInfo.Ref != "" { cloneArgs = append(cloneArgs, "--branch", build.GitInfo.Ref) } ``` Preferring `build.GitInfo.Sha` when it is non-empty restores the same guarantee the fetch path gets from `+<sha>:refs/pipelines/<id>`. Gitaly has served arbitrary-SHA wants by default since GitLab 13.2 (gitlab-org/gitaly!2349), which is the same property `writeRefspecFetchCmd` has depended on for years — see gitlab-org/gitlab!51208, which switched the refspec from the ref form to the SHA form and described the two as equivalent. They are equivalent for branch pipelines. They are not equivalent for merged results. I have confirmed this block is unchanged in `v19.0.1`, `v19.2.0`, and `main`. Two related notes: - `GIT_CLONE_EXTRA_FLAGS` is appended after `--revision` (`cloneArgs = append(cloneArgs, build.GetGitCloneFlags()...)`), so appending `--revision $CI_COMMIT_SHA` appears to work as a user-side mitigation via Git's last-occurrence-wins argument handling. That should not be the supported answer, but it may be worth documenting as a workaround until this is fixed. - `doc/ci/troubleshooting.md` in `gitlab-org/gitlab` still states that the runner fetches the persistent pipeline ref and that it stays intact during pipeline execution. That is now false whenever native clone is enabled, and the doc should be qualified alongside whatever fix lands here.