[JENKINS-63668] After removal of approval, usage does not trigger re-approval

Culprit: https://github.com/jenkinsci/script-security-plugin/blob/fcb41b7e540a6e0a53f89098e1fb6cc5210195a3/src/main/java/org/jenkinsci/plugins/scriptsecurity/scripts/ScriptApproval.java#L637

Source: https://github.com/jenkinsci/script-security-plugin/pull/300#issuecomment-678970315

From Daniel:

As 'user', create a Pipeline, write a script that hasn't been used before, disable sandbox, save.

As 'user', build the job, it fails

As 'admin', approve the script.

As 'user' build the job, it works

As 'admin', delete from approvals

As 'user', build the job, it fails

Expected: Script is now pending approval

Actual: It's neither approved nor pending

It's currently blocking the UI enhancement PR.

Current workaround, you need to re-configure the code that is using the script. Just executing it will not trigger the approval request.

---
Originally reported by wfollonier, imported from: After removal of approval, usage does not trigger re-approval

• status: Open
  
• priority: Major
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-09
  

Raw content of original issue

Culprit: https://github.com/jenkinsci/script-security-plugin/blob/fcb41b7e540a6e0a53f89098e1fb6cc5210195a3/src/main/java/org/jenkinsci/plugins/scriptsecurity/scripts/ScriptApproval.java#L637


Source: https://github.com/jenkinsci/script-security-plugin/pull/300#issuecomment-678970315


From Daniel:


As 'user', create a Pipeline, write a script that hasn't been used before, disable sandbox, save.

As 'user', build the job, it fails

As 'admin', approve the script.

As 'user' build the job, it works

As 'admin', delete from approvals

As 'user', build the job, it fails

Expected: Script is now pending approval

Actual: It's neither approved nor pending


It's currently blocking the UI enhancement PR. 


Current workaround, you need to re-configure the code that is using the script. Just executing it will not trigger the approval request.