Only allow branches/tags, disallow SHA:

app/models/ci/pipeline.rb

@@ -20,12 +20,9 @@ module Ci
     after_touch :update_state
     after_save :keep_around_commits
 
-    # ref can't be HEAD, can only be branch/tag name or SHA
+    # ref can't be HEAD or SHA, can only be branch/tag name
     scope :latest_successful_for, ->(ref) do
-      table = quoted_table_name
-      # TODO: Use `where(ref: ref).or(sha: ref)` in Rails 5
-      where("#{table}.ref = ? OR #{table}.sha = ?", ref, ref).
-        success.order(id: :desc)
+      where(ref: ref).success.order(id: :desc)
     end
 
     def self.truncate_sha(sha)

spec/requests/api/builds_spec.rb

@@ -255,14 +255,6 @@ describe API::API, api: true do
         create(:ci_build, status, :artifacts, pipeline: new_pipeline)
       end
 
-      context 'with sha' do
-        before do
-          get path_from_ref(pipeline.sha)
-        end
-
-        it('gives the file') { verify }
-      end
-
       context 'with regular branch' do
         before do
           pipeline.update(ref: 'master',