[JENKINS-60697] readTrusted does not honor the refspec on Pipeline script from SCM GIT

In a pipeline script from SCM, using a git repository with Refspec, readTrusted is not using the refsspec are fails with error "Couldn't find remote ref".

Example

Pipeline job created and configured as Pipeline script from SCM with the following parameters:

• SCM: Git


• Repository URL: git@​git.serv.d.net:ts-source.git


• Refspec: +refs/heads/*:refs/remotes/origin/* +refs/changes/*:refs/remotes/origin/*


• Branch Specifier: 4eedb3b


• Script Path: .jenkins/test.groovy

.jenkins/test.groovy

println readTrusted(".jenkins/test.groovy")

Build log

Checking out git git@​git.serv.d.net:ts-source.git into /var/lib/jenkins/jobs/wftest/workspace@​script to read .jenkins/test.groovy

No credentials specified

 > git rev-parse --is-inside-work-tree # timeout=10Fetching changes from the remote Git repository

 > git config remote.origin.url git@​git.serv.d.net:ts-source.git # timeout=10Fetching upstream changes from git@​git.serv.d.net:ts-source.git

 > git --version # timeout=10

 > git fetch --tags --progress git@​git.serv.d.net:ts-source.git +refs/heads/*:refs/remotes/origin/* +refs/changes/*:refs/remotes/origin/*

 > git rev-parse 4eedb3b^{commit} # timeout=10Checking out Revision 4eedb3baaa6d528d22180784e0001d99d618bda9 (detached) > git config core.sparsecheckout # timeout=10

 > git checkout -f 4eedb3baaa6d528d22180784e0001d99d618bda9Commit message: ".jenkins: make the jobseed job running in sandbox"

 > git rev-list --no-walk 3c75ef69338675fe751d97af3173c206aef58d94 # timeout=10

Running in Durability level: MAX_SURVIVABILITY

[Pipeline] Start of Pipeline

[Pipeline] readTrusted

[Pipeline] End of Pipeline

hudson.plugins.git.GitException: Command "git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b --prune" returned status code 128:

fatal: Couldn't find remote ref refs/heads/4eedb3b

fatal: The remote end hung up unexpectedly 


    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2042)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1761)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$400(CliGitAPIImpl.java:72)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:442)     at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:351)     at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:198)     at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:174)     at org.jenkinsci.plugins.workflow.multibranch.ReadTrustedStep$Execution.run(ReadTrustedStep.java:101)     at org.jenkinsci.plugins.workflow.multibranch.ReadTrustedStep$Execution.run(ReadTrustedStep.java:82)     at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)     at hudson.security.ACL.impersonate(ACL.java:290)     at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)     at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)     at java.util.concurrent.FutureTask.run(FutureTask.java:266)     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)     at java.lang.Thread.run(Thread.java:748) Finished: FAILURE

 

The expected behavior is that readTrusted results in

git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b +refs/config/4eedb3b:refs/remotes/origin/4eedb3b --prune

However

git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b --prune

is used.

---
Originally reported by weltfahr, imported from: readTrusted does not honor the refspec on Pipeline script from SCM GIT

• status: Open
  
• priority: Major
  
• component(s): workflow-multibranch-plugin
  
• label(s): git, pipeline
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 20251212-090250
  

Raw content of original issue

In a pipeline script from SCM, using a git repository with Refspec, readTrusted is not using the refsspec are fails with error "Couldn't find remote ref".


Example


Pipeline job created and configured as Pipeline script from SCM with the following parameters:



	
SCM: Git

	
Repository URL: git@git.serv.d.net:ts-source.git

	
Refspec: +refs/heads/*:refs/remotes/origin/* +refs/changes/*:refs/remotes/origin/*

	
Branch Specifier: 4eedb3b

	
Script Path: .jenkins/test.groovy



.jenkins/test.groovy



println readTrusted(".jenkins/test.groovy")





Build log



Checking out git git@git.serv.d.net:ts-source.git into /var/lib/jenkins/jobs/wftest/workspace@script to read .jenkins/test.groovy

No credentials specified

 > git rev-parse --is-inside-work-tree # timeout=10Fetching changes from the remote Git repository

 > git config remote.origin.url git@git.serv.d.net:ts-source.git # timeout=10Fetching upstream changes from git@git.serv.d.net:ts-source.git

 > git --version # timeout=10

 > git fetch --tags --progress git@git.serv.d.net:ts-source.git +refs/heads/*:refs/remotes/origin/* +refs/changes/*:refs/remotes/origin/*

 > git rev-parse 4eedb3b^{commit} # timeout=10Checking out Revision 4eedb3baaa6d528d22180784e0001d99d618bda9 (detached) > git config core.sparsecheckout # timeout=10

 > git checkout -f 4eedb3baaa6d528d22180784e0001d99d618bda9Commit message: ".jenkins: make the jobseed job running in sandbox"

 > git rev-list --no-walk 3c75ef69338675fe751d97af3173c206aef58d94 # timeout=10

Running in Durability level: MAX_SURVIVABILITY

[Pipeline] Start of Pipeline

[Pipeline] readTrusted

[Pipeline] End of Pipeline

hudson.plugins.git.GitException: Command "git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b --prune" returned status code 128:

fatal: Couldn't find remote ref refs/heads/4eedb3b

fatal: The remote end hung up unexpectedly 


    at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandIn(CliGitAPIImpl.java:2042)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.launchCommandWithCredentials(CliGitAPIImpl.java:1761)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl.access$400(CliGitAPIImpl.java:72)     at org.jenkinsci.plugins.gitclient.CliGitAPIImpl$1.execute(CliGitAPIImpl.java:442)     at jenkins.plugins.git.GitSCMFileSystem$BuilderImpl.build(GitSCMFileSystem.java:351)     at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:198)     at jenkins.scm.api.SCMFileSystem.of(SCMFileSystem.java:174)     at org.jenkinsci.plugins.workflow.multibranch.ReadTrustedStep$Execution.run(ReadTrustedStep.java:101)     at org.jenkinsci.plugins.workflow.multibranch.ReadTrustedStep$Execution.run(ReadTrustedStep.java:82)     at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1$1.call(AbstractSynchronousNonBlockingStepExecution.java:47)     at hudson.security.ACL.impersonate(ACL.java:290)     at org.jenkinsci.plugins.workflow.steps.AbstractSynchronousNonBlockingStepExecution$1.run(AbstractSynchronousNonBlockingStepExecution.java:44)     at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)     at java.util.concurrent.FutureTask.run(FutureTask.java:266)     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)     at java.lang.Thread.run(Thread.java:748) Finished: FAILURE





 

The expected behavior is that readTrusted results in




git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b +refs/config/4eedb3b:refs/remotes/origin/4eedb3b --prune





However




git fetch --tags --progress origin +refs/heads/4eedb3b:refs/remotes/origin/4eedb3b --prune





is used.

environment

```
OS: Alpine Linux 3.8.4 x64

Open JDK 8

Jenkins 2.176.1
```