We have a pipeline job that specifies a commit SHA as branch spec.

As described at plugin/job-dsl/api-viewer/index.html#path/pipelineJob-definition-cpsScm-scm-gitSCM-branches-branchSpec-name

• <commitId>Checks out the specified commit.E.g. 5062ac843f2b947733e6a3b105977056821bd352, 5062ac84, ...

This works as long as lightweight checkout is disabled, which means SCMFileSystem is not used. 

See here: https://github.com/jenkinsci/workflow-cps-plugin/blob/ef35de2396200112c03fd56359f7691a6de23dc3/plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/CpsScmFlowDefinition.java#L117 

When lightweight checkout is enabled the error described below happens. 

hudson.plugins.git.GitException: Command "git fetch --tags --force --progress --prune – origin +refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f:refs/remotes/origin/15b834bad5c89087e90b2dcee263ece1af328a9f" returned status code 128: stdout: stderr: fatal: couldn't find remote ref refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f

The same thing happens with readTrusted, which is used by the Kubernetes plugin to read yaml files and which actually sent me on this hunt.

Our pipeline job was always started correctly, the pipeline file was pulled from the right commit and then it failed to pull the yaml file with the error message shown above.

Fixing readTrusted can be done by specifying 

Dorg.jenkinsci.plugins.workflow.multibranch.SCMBinder.USE_HEAVYWEIGHT_CHECKOUT=true

To force it to not use SCMFileSystem.

This could be fixed more cleanly by having GitSCMFileSystem work with commits, but I am not sure how.

Another way would be to somehow change the supports() method to return false in case a commit is given.

https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L257

But I don't see a way to differentiate between a commit SHA and a branch name. 

The actual wrong behavior in all of this is happening here:
https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L404

instead of a proper ref the commit SHA will be used here.

The following two links describe the same symptoms and will probably be the same issue.

https://issues.jenkins.io/browse/JENKINS-60697

https://stackoverflow.com/questions/69116849/gerrit-refspec-not-recognized-during-scm-git-checkout-jenkinsfile-declarative