[JENKINS-64733] Issues with untrusted PR build runs

We have 2 instances of Jenkins setup - 1 for QA purposes like testing Jenkins upgrades, new plugin installs etc.

We use Github branch source plugin to contact Github Enterprise. Recently, we noticed that the Discover pull requests from forks with Trust: From users with Admin or Write access  (or Nobody for that matter) isn't working as intended in one of the instances.

 

The QA instance pipeline seems to run without any issues whereas in the PROD instance, PR build triggered by forks from users with only Read access fails with the following:

 

Branch indexing  

Connecting to https://github.redacted.com/api/v3 using 10/****** (Credential for redacted)  

Connecting to https://github.redacted.com/api/v3 to check permissions of obtain list of redacted_username for redacted_orgname/redacted_reponame  

Loading trusted files from base branch master at target_commit_hash rather than source_commit_hash 

GitHub has been notified of this commit’s build result  

hudson.plugins.git.GitException: Command "git fetch --tags --progress --prune origin +refs/heads/*:refs/remotes/origin/*" returned status code 128:stdout:

stderr: remote: Repository not found.

fatal: repository 'https://github.redacted.com/orgname/reponame.git/' not foundat org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$500(CliGitAPIImpl.java:84)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:573)

at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:408)

at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:293)

at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:103)

at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:309)

at hudson.model.ResourceController.execute(ResourceController.java:97)

at hudson.model.Executor.run(Executor.java:428)

 

Finished: FAILURE

 

I'm not quite sure how to debug this since the behavior is pretty strange. This is blocking some of our teams since they want readers to be able to create/run builds for forked PRs.

---
Originally reported by blundercon, imported from: Issues with untrusted PR build runs

• status: Open
  
• priority: Blocker
  
• component(s): github-branch-source-plugin
  
• label(s): github-branch-source-plugin, jenkins, plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-02
  

Raw content of original issue

We have 2 instances of Jenkins setup - 1 for QA purposes like testing Jenkins upgrades, new plugin installs etc.


We use Github branch source plugin to contact Github Enterprise. Recently, we noticed that the Discover pull requests from forks with Trust: From users with Admin or Write access  (or Nobody for that matter) isn't working as intended in one of the instances.


 


The QA instance pipeline seems to run without any issues whereas in the PROD instance, PR build triggered by forks from users with only Read access fails with the following:


 



Branch indexing  

Connecting to https://github.redacted.com/api/v3 using 10/****** (Credential for redacted)  

Connecting to https://github.redacted.com/api/v3 to check permissions of obtain list of redacted_username for redacted_orgname/redacted_reponame  

Loading trusted files from base branch master at target_commit_hash rather than source_commit_hash 

GitHub has been notified of this commit’s build result  

hudson.plugins.git.GitException: Command "git fetch --tags --progress --prune origin +refs/heads/*:refs/remotes/origin/*" returned status code 128:stdout:

stderr: remote: Repository not found.

fatal: repository 'https://github.redacted.com/orgname/reponame.git/' not foundat org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2450)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:2051)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$500(CliGitAPIImpl.java:84)

at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:573)

at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:408)

at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:293)

at org.jenkinsci.plugins.workflow.multibranch.SCMBinder.create(SCMBinder.java:103)

at org.jenkinsci.plugins.workflow.job.WorkflowRun.run(WorkflowRun.java:309)

at hudson.model.ResourceController.execute(ResourceController.java:97)

at hudson.model.Executor.run(Executor.java:428)

 

Finished: FAILURE





 


I'm not quite sure how to debug this since the behavior is pretty strange. This is blocking some of our teams since they want readers to be able to create/run builds for forked PRs.

environment

```
Operating System: Linux

Jenkins: v2.249.1

Github Branch Source Plugin: v2.9.2
```