more updates

internal/config/loader.go

@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	"gopkg.in/yaml.v3"
 )
@@ -39,6 +40,9 @@ func validate(cfg *KforgeConfig) error {
 	if cfg.Meta.Tenant == "" {
 		return fmt.Errorf("meta.tenant is required")
 	}
+	if cfg.ActionRef != "" && (strings.Contains(cfg.ActionRef, "@") && !strings.Contains(cfg.ActionRef, "@sha256:")) {
+		return fmt.Errorf("action_ref %q looks like a git ref — use a Docker image tag instead (e.g. registry.example.com/infra/kforge:latest)", cfg.ActionRef)
+	}
 	if len(cfg.Environments) == 0 {
 		return fmt.Errorf("at least one environment must be defined")
 	}

internal/generator/gitea_actions.go

@@ -74,6 +74,10 @@ func writeDeployJobs(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaAct
 		"with": map[string]any{"fetch-depth": 0},
 	})
 
+	writeStep(b, "Create short SHA", map[string]any{
+		"run": `echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV`,
+	})
+
 	writeStep(b, "Login to registry", map[string]any{
 		"uses": "docker/login-action@v2",
 		"with": map[string]any{
@@ -129,10 +133,6 @@ func writeActionDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, opts G
 
 // writeInlineDeploySteps emits the classic multi-step inline approach.
 func writeInlineDeploySteps(b *strings.Builder, cfg *config.KforgeConfig, opts GiteaActionsOptions) {
-	writeStep(b, "Create short commit hash", map[string]any{
-		"run": `echo "SHORT_SHA=$(git rev-parse --short HEAD)" >> $GITHUB_ENV`,
-	})
-
 	writeStep(b, "Install kforge", map[string]any{
 		"run": "KFORGE_VERSION=\"latest\"\ncurl -fsSL \"https://kforge/releases/download/${KFORGE_VERSION}/kforge-linux-amd64\" -o /usr/local/bin/kforge\nchmod +x /usr/local/bin/kforge",
 	})