[JENKINS-76287] ClassCastException when using repository access strategy

The following error occurs when we set a repository access strategy on a github app credential:

```
hudson.remoting.ProxyException: java.lang.ClassCastException: class java.lang.String cannot be cast to class java.lang.Enum (java.lang.String and java.lang.Enum are in module java.base of loader 'bootstrap')
at PluginClassLoader for github-api//org.kohsuke.github.GHAppCreateTokenBuilder.permissions(GHAppCreateTokenBuilder.java:94)
at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:331)
at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:768)
at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:753)
at hudson.remoting.UserRequest.perform(UserRequest.java:225)
at hudson.remoting.UserRequest.perform(UserRequest.java:50)
at hudson.remoting.Request$2.run(Request.java:391)
at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:81)
at org.jenkinsci.remoting.CallableDecorator.call(CallableDecorator.java:18)
at hudson.remoting.CallableDecoratorList.lambda$applyDecorator$0(CallableDecoratorList.java:21)
at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:80)
at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
```

It seems this is a bug in https://github.com/jenkinsci/github-branch-source-plugin/blob/9ee8a39b3d0d7f201187b0013d8d5daf3a37a047/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java#L775 where an improper cast is done from JSONObject to Map. At best it's probably safe to say Map, but the map value has to be deserialized back to the GHPermissionType enum.

---
Originally reported by thatsmydoing, imported from: ClassCastException when using repository access strategy

• status: Open
  
• priority: Minor
  
• component(s): github-branch-source-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-02
  

Raw content of original issue

The following error occurs when we set a repository access strategy on a github app credential:



hudson.remoting.ProxyException: java.lang.ClassCastException: class java.lang.String cannot be cast to class java.lang.Enum (java.lang.String and java.lang.Enum are in module java.base of loader 'bootstrap')

		at PluginClassLoader for github-api//org.kohsuke.github.GHAppCreateTokenBuilder.permissions(GHAppCreateTokenBuilder.java:94)

		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:331)

		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:768)

		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:753)

		at hudson.remoting.UserRequest.perform(UserRequest.java:225)

		at hudson.remoting.UserRequest.perform(UserRequest.java:50)

		at hudson.remoting.Request$2.run(Request.java:391)

		at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:81)

		at org.jenkinsci.remoting.CallableDecorator.call(CallableDecorator.java:18)

		at hudson.remoting.CallableDecoratorList.lambda$applyDecorator$0(CallableDecoratorList.java:21)

		at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)

		at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:80)

		at java.base/java.util.concurrent.FutureTask.run(Unknown Source)

		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)

		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)



It seems this is a bug in https://github.com/jenkinsci/github-branch-source-plugin/blob/9ee8a39b3d0d7f201187b0013d8d5daf3a37a047/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java#L775 where an improper cast is done from JSONObject to Map<String, GHPermissionType>. At best it's probably safe to say Map<String, String>, but the map value has to be deserialized back to the GHPermissionType enum.

environment

```
Jenkins: 2.528.1

OS: Linux - 6.1.153-175.280.amzn2023.x86_64

Java: 21.0.8 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)

github-branch-source:1917.v9ee8a_39b_3d0d
```