Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-64733

Issues with untrusted PR build runs

    XMLWordPrintable

    Details

    • Similar Issues:

      Description

      We have 2 instances of Jenkins setup - 1 for QA purposes like testing Jenkins upgrades, new plugin installs etc.

      We use Github branch source plugin to contact Github Enterprise. Recently, we noticed that the Discover pull requests from forks with Trust: From users with Admin or Write access  (or Nobody for that matter) isn't working as intended in one of the instances.

       

      The QA instance pipeline seems to run without any issues whereas in the PROD instance, PR build triggered by forks from users with only Read access fails with the following:

       

      Branch indexing  
      Connecting to https://github.redacted.com/api/v3 using 10/****** (Credential for redacted)  
      Connecting to https://github.redacted.com/api/v3 to check permissions of obtain list of redacted_username for redacted_orgname/redacted_reponame  
      Loading trusted files from base branch master at target_commit_hash rather than source_commit_hash 
      GitHub has been notified of this commit’s build result  
      hudson.plugins.git.GitException: Command "git fetch --tags --progress --prune origin +refs/heads/*:refs/remotes/origin/*" returned status code 128:stdout:
      stderr: remote: Repository not found.
      fatal: repository 'https://github.redacted.com/orgname/reponame.git/' not foundat org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$500(CliGitAPIImpl.java:84)
      at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:573)
      at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:408)
      at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:293)
      at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:103)
      at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:309)
      at hudson.model.ResourceController.execute(ResourceController.java:97)
      at hudson.model.Executor.run(Executor.java:428)
       
      Finished: FAILURE
      

       

      I'm not quite sure how to debug this since the behavior is pretty strange. This is blocking some of our teams since they want readers to be able to create/run builds for forked PRs.

        Attachments

          Activity

          Hide
          blundercon Harikishen Hosamana added a comment -

          Any updates here?

          Show
          blundercon Harikishen Hosamana added a comment - Any updates here?

            People

            Assignee:
            Unassigned Unassigned
            Reporter:
            blundercon Harikishen Hosamana
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Dates

              Created:
              Updated: