[JENKINS-75883] credentials defined in a repo of an org older get removed if the org folder is updates

currently there is the ability to create credentials on a job for a given reposotory or a job for a given branch in an organisation folder.

However these credentials are periodically lost.

Steps to reproduce

Create a Github Org folder that will pickup a repository in a GitHub organisation and create builds.

Run the scan so that projects and branches are created

in a job for a specific repository define a credential

update the GH org folder configuration

Run another scan so that projects are updated.

Expected Results

The credential defined on the job is still present

Actual Results

The credential defined on the job is lost

Notes: The UI currently allows the creation of the credential. the branch API has no ability no manage credentials on the job, so these could be explicitly excluded from management.

jglick believes allowing credentials to be created here is incorrect, so an alternative expectation is that credentials can not be created on jobs for repositories or their branches/PRs.

---
Originally reported by teilo, imported from: credentials defined in a repo of an org older get removed if the org folder is updates

• status: Open
  
• priority: Major
  
• component(s): branch-api-plugin, cloudbees-folder-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 2
  
• imported: 20251211-141027
  

Raw content of original issue

currently there is the ability to create credentials on a job for a given reposotory or a job for a given branch in an organisation folder.

However these credentials are periodically lost.


Steps to reproduce


Create a Github Org folder that will pickup a repository in a GitHub organisation and create builds.

Run the scan so that projects and branches are created

in a job for a specific repository define a credential

update the GH org folder configuration

Run another scan so that projects are updated.


Expected Results


The credential defined on the job is still present


Actual Results


The credential defined on the job is lost


Notes:   The UI currently allows the creation of the credential.  the branch API has no ability no manage credentials on the job, so these could be explicitly excluded from management.


jglick believes allowing credentials to be created here is incorrect, so an alternative expectation is that credentials can not be created on jobs for repositories or their branches/PRs.

Start with the branch API's job credential management and the organization-folder scan/update path described in the reproduction steps. Reproduce the issue by updating the GitHub organization folder and scanning again. Done means the credential remains available, or the UI no longer permits creating credentials there once the intended behavior is decided.

Written by the indexing model from the issue text.