[JENKINS-47377] GitHub Branch Source should correctly clone submodules

Observed Behavior:

Using github-branch-source plugin, Jenkins detects and attempts to build a repo with a Jenkinsfile. advanced submodule behavior is enabled. It gets as far as cloning down the submodules (which are also private repos under the same account) and fails. Log follows:

```
Cloning the remote Git repository
Cloning repository https://github.com/anchorfree/vpn-sniproxy.git
> git init /jenkins/workspace/horfree_vpn-sniproxy_master-7W5YHEMAJEKYONQ4KHLIVFWIOSGQLKDT7VDARS2FNXQKZT6YHLTA # timeout=10
Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git
> git --version # timeout=10
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/*:refs/remotes/origin/*
> git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10
Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/master:refs/remotes/origin/master
Checking out Revision bb9de965217374fbef1731e74ed6a390f88e50df (master)
Enabling Git LFS pull
> git config core.sparsecheckout # timeout=10
> git checkout -f bb9de965217374fbef1731e74ed6a390f88e50df
> git config --get remote.origin.url # timeout=10
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git lfs pull origin
Commit message: "add Jenkinsfile and fix build"
> git rev-list bb9de965217374fbef1731e74ed6a390f88e50df # timeout=10
> git remote # timeout=10
> git submodule init # timeout=10
> git submodule sync # timeout=10
> git config --get remote.origin.url # timeout=10
> git submodule init # timeout=10
> git config -f .gitmodules --get-regexp ^submodule\.(.*)\.url # timeout=10
> git config --get submodule.af-bureau.url # timeout=10
> git config -f .gitmodules --get submodule.af-bureau.path # timeout=10
> git submodule update --init --recursive af-bureau
Command "git submodule update --init --recursive af-bureau" returned status code 128:
stdout:
stderr: Cloning into 'af-bureau'...
Host key verification failed.
fatal: Could not read from remote repository.
Please make sure you have the correct access rights
and the repository exists.
fatal: clone of 'git@​github.com:AnchorFree/af-bureau.git' into submodule path 'af-bureau' failed

```

Attempting with an https git url:

```
Cloning the remote Git repository
Cloning repository https://github.com/anchorfree/vpn-sniproxy.git
> git init /jenkins/workspace/horfree_vpn-sniproxy_master-7W5YHEMAJEKYONQ4KHLIVFWIOSGQLKDT7VDARS2FNXQKZT6YHLTA # timeout=10
Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git
> git --version # timeout=10
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/*:refs/remotes/origin/*
> git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10
> git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10
> git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10
Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/master:refs/remotes/origin/master
Checking out Revision d0b3fdd723de2df772020a3e80454d83d1301a5c (master)
Enabling Git LFS pull
> git config core.sparsecheckout # timeout=10
> git checkout -f d0b3fdd723de2df772020a3e80454d83d1301a5c
> git config --get remote.origin.url # timeout=10
using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials
> git lfs pull origin
Commit message: "will https submodules Just Work for Jenkins builds?"
> git rev-list f6e18d076844cf7a2f2e66e528dc9fae0e35c944 # timeout=10
> git remote # timeout=10
> git submodule init # timeout=10
> git submodule sync # timeout=10
> git config --get remote.origin.url # timeout=10
> git submodule init # timeout=10
> git config -f .gitmodules --get-regexp ^submodule\.(.*)\.url # timeout=10
> git config --get submodule.libtoolz.url # timeout=10
> git config -f .gitmodules --get submodule.libtoolz.path # timeout=10
> git submodule update --init --recursive libtoolz
Command "git submodule update --init --recursive libtoolz" returned status code 128:
stdout:
stderr: Cloning into 'libtoolz'...
remote: Invalid username or password.
fatal: Authentication failed for 'https://github.com/AnchorFree/libtoolz.git/'
fatal: clone of 'https://github.com/AnchorFree/libtoolz.git' into submodule path 'libtoolz' failed

```

Expected Behavior:

Jenkins should succeed when cloning submodules when it already has the necessary permissions via the github-branch-source plugin.

 

---
Originally reported by ahammond, imported from: GitHub Branch Source should correctly clone submodules

• status: Open
  
• priority: Major
  
• component(s): github-branch-source-plugin
  
• resolution: Unresolved
  
• votes: 2
  
• watchers: 3
  
• imported: 2025-12-02
  

Raw content of original issue

Observed Behavior:


Using github-branch-source plugin, Jenkins detects and attempts to build a repo with a Jenkinsfile. advanced submodule behavior is enabled. It gets as far as cloning down the submodules (which are also private repos under the same account) and fails. Log follows:



Cloning the remote Git repository

Cloning repository https://github.com/anchorfree/vpn-sniproxy.git

 > git init /jenkins/workspace/horfree_vpn-sniproxy_master-7W5YHEMAJEKYONQ4KHLIVFWIOSGQLKDT7VDARS2FNXQKZT6YHLTA # timeout=10

Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git

 > git --version # timeout=10

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/*:refs/remotes/origin/*

 > git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10

 > git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10

 > git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10

Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/master:refs/remotes/origin/master

Checking out Revision bb9de965217374fbef1731e74ed6a390f88e50df (master)

Enabling Git LFS pull

 > git config core.sparsecheckout # timeout=10

 > git checkout -f bb9de965217374fbef1731e74ed6a390f88e50df

 > git config --get remote.origin.url # timeout=10

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git lfs pull origin

Commit message: "add Jenkinsfile and fix build"

 > git rev-list bb9de965217374fbef1731e74ed6a390f88e50df # timeout=10

 > git remote # timeout=10

 > git submodule init # timeout=10

 > git submodule sync # timeout=10

 > git config --get remote.origin.url # timeout=10

 > git submodule init # timeout=10

 > git config -f .gitmodules --get-regexp ^submodule\.(.*)\.url # timeout=10

 > git config --get submodule.af-bureau.url # timeout=10

 > git config -f .gitmodules --get submodule.af-bureau.path # timeout=10

 > git submodule update --init --recursive af-bureau

Command "git submodule update --init --recursive af-bureau" returned status code 128:

stdout: 

stderr: Cloning into 'af-bureau'...

Host key verification failed.

fatal: Could not read from remote repository.

Please make sure you have the correct access rights

and the repository exists.

fatal: clone of 'git@github.com:AnchorFree/af-bureau.git' into submodule path 'af-bureau' failed





Attempting with an https git url:



Cloning the remote Git repository

Cloning repository https://github.com/anchorfree/vpn-sniproxy.git

 > git init /jenkins/workspace/horfree_vpn-sniproxy_master-7W5YHEMAJEKYONQ4KHLIVFWIOSGQLKDT7VDARS2FNXQKZT6YHLTA # timeout=10

Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git

 > git --version # timeout=10

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/*:refs/remotes/origin/*

 > git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10

 > git config --add remote.origin.fetch +refs/heads/*:refs/remotes/origin/* # timeout=10

 > git config remote.origin.url https://github.com/anchorfree/vpn-sniproxy.git # timeout=10

Fetching upstream changes from https://github.com/anchorfree/vpn-sniproxy.git

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git fetch --tags --progress https://github.com/anchorfree/vpn-sniproxy.git +refs/heads/master:refs/remotes/origin/master

Checking out Revision d0b3fdd723de2df772020a3e80454d83d1301a5c (master)

Enabling Git LFS pull

 > git config core.sparsecheckout # timeout=10

 > git checkout -f d0b3fdd723de2df772020a3e80454d83d1301a5c

 > git config --get remote.origin.url # timeout=10

using GIT_ASKPASS to set credentials Jenkins Global Pipeline Libraries scan credentials

 > git lfs pull origin

Commit message: "will https submodules Just Work for Jenkins builds?"

 > git rev-list f6e18d076844cf7a2f2e66e528dc9fae0e35c944 # timeout=10

 > git remote # timeout=10

 > git submodule init # timeout=10

 > git submodule sync # timeout=10

 > git config --get remote.origin.url # timeout=10

 > git submodule init # timeout=10

 > git config -f .gitmodules --get-regexp ^submodule\.(.*)\.url # timeout=10

 > git config --get submodule.libtoolz.url # timeout=10

 > git config -f .gitmodules --get submodule.libtoolz.path # timeout=10

 > git submodule update --init --recursive libtoolz

Command "git submodule update --init --recursive libtoolz" returned status code 128:

stdout: 

stderr: Cloning into 'libtoolz'...

remote: Invalid username or password.

fatal: Authentication failed for 'https://github.com/AnchorFree/libtoolz.git/'

fatal: clone of 'https://github.com/AnchorFree/libtoolz.git' into submodule path 'libtoolz' failed





Expected Behavior:


Jenkins should succeed when cloning submodules when it already has the necessary permissions via the github-branch-source plugin.


 

environment

```
JENKINS_VERSION 2.73.1

ace-editor 1.1 true

apache-httpcomponents-client-4-api 4.5.3-2.0 true

authentication-tokens 1.3 true

aws-java-sdk 1.11.119 true

blueocean 1.2.4 true

blueocean-autofavorite 1.0.0 true

blueocean-bitbucket-pipeline 1.2.4 true

blueocean-commons 1.2.4 true

blueocean-config 1.2.4 true

blueocean-dashboard 1.2.4 true

blueocean-display-url 2.1.0 true

blueocean-events 1.2.4 true

blueocean-git-pipeline 1.2.4 true

blueocean-github-pipeline 1.2.4 true

blueocean-i18n 1.2.4 true

blueocean-jira 1.2.4 true

blueocean-jwt 1.2.4 true

blueocean-personalization 1.2.4 true

blueocean-pipeline-api-impl 1.2.4 true

blueocean-pipeline-editor 1.2.4 true

blueocean-pipeline-scm-api 1.2.4 true

blueocean-rest 1.2.4 true

blueocean-rest-impl 1.2.4 true

blueocean-web 1.2.4 true

branch-api 2.0.11 true

cloudbees-bitbucket-branch-source 2.2.3 true

cloudbees-folder 6.1.2 true

copyartifact 1.38.1 true

credentials 2.1.16 true

credentials-binding 1.13 true

digitalocean-plugin 0.12 true

display-url-api 2.0 true

docker-build-step 1.43 true

docker-commons 1.8 true

docker-workflow 1.13 true

durable-task 1.14 true

embeddable-build-status 1.9 true

favorite 2.3.0 true

git 3.6.0 true

git-client 2.5.0 true

git-server 1.7 true

github 1.28.0 true

github-api 1.89 true

github-branch-source 2.2.3 true

github-oauth 0.27 true

htmlpublisher 1.14 true

icon-shim 2.0.3 true

jackson2-api 2.7.3 true

javadoc 1.4 true

jira 2.4.2 true

jquery-detached 1.2.1 true

jsch 0.1.54.1 true

junit 1.21 true

lockable-resources 2.0 true

mailer 1.20 true

matrix-auth 1.7 true

matrix-project 1.12 true

maven-plugin 3.0-rc2 true

mercurial 2.1 true

metrics 3.1.2.10 true

pegdown-formatter 1.3 true

pipeline-aws 1.15 true

pipeline-build-step 2.5.1 true

pipeline-graph-analysis 1.5 true

pipeline-input-step 2.8 true

pipeline-milestone-step 1.3.1 true

pipeline-model-api 1.2.1 true

pipeline-model-declarative-agent 1.1.1 true

pipeline-model-definition 1.2.1 true

pipeline-model-extensions 1.2.1 true

pipeline-stage-step 2.2 true

pipeline-stage-tags-metadata 1.2.1 true

plain-credentials 1.4 true

prometheus 1.1.0 true

pubsub-light 1.12 true

rebuild 1.25 true

s3 0.10.12 true

scm-api 2.2.2 true

script-security 1.34 true

sse-gateway 1.15 true

ssh-credentials 1.13 true

structs 1.10 true

timestamper 1.8.8 true

token-macro 2.3 true

variant 1.1 true

workflow-api 2.22 true

workflow-basic-steps 2.6 true

workflow-cps 2.41 true

workflow-cps-global-lib 2.9 true

workflow-durable-task-step 2.15 true

workflow-job 2.14.1 true

workflow-multibranch 2.16 true

workflow-scm-step 2.6 true

workflow-step-api 2.13 true

workflow-support 2.15 true

```