Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-36240

Default repository permission are not considered

XMLWordPrintable

      If the permissions of an user are granted on organization membership rather than team membership. The PR from the user aren't considered trusted. But are considered if the user push directly to the repository.

          [JENKINS-36240] Default repository permission are not considered

          Emilio Escobar created issue -
          Jesse Glick made changes -
          Remote Link New: This issue links to "current poor implementation (Web Link)" [ 14597 ]
          R. Tyler Croy made changes -
          Workflow Original: JNJira [ 172934 ] New: JNJira + In-Review [ 184836 ]
          Jesse Glick made changes -
          Link New: This issue is related to JENKINS-37608 [ JENKINS-37608 ]
          Jesse Glick made changes -
          Assignee Original: Jesse Glick [ jglick ]
          Jesse Glick made changes -
          Assignee New: Jesse Glick [ jglick ]
          Jesse Glick made changes -
          Status Original: Open [ 1 ] New: In Progress [ 3 ]
          Jesse Glick made changes -
          Remote Link New: This issue links to "PR 96 (Web Link)" [ 15139 ]
          Jesse Glick made changes -
          Status Original: In Progress [ 3 ] New: In Review [ 10005 ]
          Ryan Campbell made changes -
          Link New: This issue is duplicated by JENKINS-40705 [ JENKINS-40705 ]
          Patrick Thiel made changes -
          Comment [ Using a multibranch pipeline project with the latest SCM API 2.0 release, we have also noticed PR's from contributors getting flagged as untrusted sources.. Despite the PR author having admin privileges as a contributor and is the member of a Github team that also has Write permissions for the repository.

          To test this..
          # Submit a PR with changes to a project's Jenkinsfile (add an echo or something)
          # Open up a PR and scan the repository.
          # Observe, In the scan log, your PR will look something like the following:

          {code}
              Checking pull request #1817
              (not from a trusted source)
              Job name: PR-1817
                ‘Jenkinsfile’ found
              Met criteria
          {code}

          Since it's not a trusted source, when building this pull request, Jenkins will revert to using the Jenkinsfile on the base branch.. The log in the Jenkins PR job will look like this:

          {code}
          Loading trusted files from base branch dev at {commit} rather than {commit}
          {code}

          Seems related to this issue. I can file another defect for this, but I wanted to check in here first. ]

            stephenconnolly Stephen Connolly
            escoem Emilio Escobar
            Votes:
            0 Vote for this issue
            Watchers:
            9 Start watching this issue

              Created:
              Updated:
              Resolved: