Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-64733

Issues with untrusted PR build runs

XMLWordPrintable

      We have 2 instances of Jenkins setup - 1 for QA purposes like testing Jenkins upgrades, new plugin installs etc.

      We use Github branch source plugin to contact Github Enterprise. Recently, we noticed that the Discover pull requests from forks with Trust: From users with Admin or Write access  (or Nobody for that matter) isn't working as intended in one of the instances.

       

      The QA instance pipeline seems to run without any issues whereas in the PROD instance, PR build triggered by forks from users with only Read access fails with the following:

       

      Branch indexing  
Connecting to https://github.redacted.com/api/v3 using 10/****** (Credential for redacted)  
Connecting to https://github.redacted.com/api/v3 to check permissions of obtain list of redacted_username for redacted_orgname/redacted_reponame  
Loading trusted files from base branch master at target_commit_hash rather than source_commit_hash 
GitHub has been notified of this commit’s build result  
hudson.plugins.git.GitException: Command "git fetch --tags --progress --prune origin +refs/heads/*:refs/remotes/origin/*" returned status code 128:stdout:
stderr: remote: Repository not found.
fatal: repository 'https://github.redacted.com/orgname/reponame.git/' not foundat org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$500(CliGitAPIImpl.java:84)
at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:573)
at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:408)
at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:293)
at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:103)
at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:309)
at hudson.model.ResourceController.execute(ResourceController.java:97)
at hudson.model.Executor.run(Executor.java:428)
 
Finished: FAILURE

       

      I'm not quite sure how to debug this since the behavior is pretty strange. This is blocking some of our teams since they want readers to be able to create/run builds for forked PRs.

            Unassigned Unassigned
            blundercon Harikishen Hosamana
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

              Created:
              Updated: