A SHA cannot be used as a ref for this purpose. The ref is meant to be
a branch name or a tag name, and it is used to decide if the branch
or tag is protected. Passing a sha results in the ref getting treated
as unprotected, unless the sha happens to match a protected branch or
tag (which is a security issue).

See https://gitlab.com/gitlab-org/gitlab/-/issues/337344