more updates

internal/config/loader.go

@@ -3,6 +3,7 @@ package config
 import (
 	"fmt"
 	"os"
+	"strings"
 
 	"gopkg.in/yaml.v3"
 )
@@ -39,6 +40,9 @@ func validate(cfg *KforgeConfig) error {
 	if cfg.Meta.Tenant == "" {
 		return fmt.Errorf("meta.tenant is required")
 	}
+	if cfg.ActionRef != "" && (strings.Contains(cfg.ActionRef, "@") && !strings.Contains(cfg.ActionRef, "@sha256:")) {
+		return fmt.Errorf("action_ref %q looks like a git ref — use a Docker image tag instead (e.g. registry.example.com/infra/kforge:latest)", cfg.ActionRef)
+	}
 	if len(cfg.Environments) == 0 {
 		return fmt.Errorf("at least one environment must be defined")
 	}