SOAR - cannot save playbook to remote GitHub repo

Applicability

Description

When trying to save a playbook in remote GitHub repo, it results in error:

Cmd('git') failed due to: exit code(128) cmdline: git merge --abort stderr: 'fatal: There is no merge to abort (MERGE_HEAD missing).'

Investigation

The following messages are in wsgi.log:

{"log_type": "django", "component": "webserver", "product_version": "6.4.1.357", "time": "2025-07-21T18:00:31.040774", "logger": "phantom_ui.phplaybooks.git_helper", "pid": 3398678, "level": "DEBUG", "file": "/opt/phantom/www/phantom_ui/phplaybooks/git_helper.py", "line": 1221, "message": "Executing: git merge cf6e74def696335234a3ba0b449a469a32549c5f remotes/origin/HEAD --no-commit",
...
{"log_type": "django", "component": "webserver", "product_version": "6.4.1.357", "time": "2025-07-21T18:00:31.057274", "logger": "phantom_ui.phplaybooks.git_helper", "pid": 3398678, "level": "WARNING", "file": "/opt/phantom/www/phantom_ui/phplaybooks/git_helper.py", "line": 1233, "message": "Cmd('git') failed due to: exit code(128)\n  cmdline: git merge cf6e74def696335234a3ba0b449a469a32549c5f --no-commit\n  stderr: 'Committer identity unknown\n\n*** Please tell me who you are.\n\nRun\n\n  git config --global user.email \"you@example.com\"\n  git config --global user.name \"Your Name\"\n\nto set your account's default identity.\nOmit --global to set the identity only in this repository.\n\nfatal: empty ident name (for <phantom@soar1-i-0bc5bba2562f6ea53.soar-saver.soar.splunkcloud.com>) not allowed'"

The message can be misleading to an authentication issue. The real issue here is shown when running "git status" due to the differences in the git commits in the SOAR and the git repository :

$cd /opt/phantom/scm/git/gh_pb_dev
$ git status
On branch main
Your branch and 'origin/main' have diverged,
and have 10 and 258 different commits each, respectively.
  (use "git pull" to merge the remote branch into yours)nothing to commit, working tree clean

Resolution

The solution is to delete the repo and recreate it when unable to push changes to the repository according to SOAR document Configure a source control repository for your Splunk SOAR (Cloud) playbooks | Splunk Docs 

If your playbook editor is blocked from pushing to the remote repository, follow these steps:Delete the repository in Git and recreate it in Splunk SOAR (Cloud), using the steps described in the Set up a playbook repository using HTTP, HTTPS, or Git section of this article. The playbook reverts to the last successful push and removes all changes made after the last successful push.
Recreate your changes and try to push again.