jenkinsci / jenkinsci/workflow-multibranch-plugin

[JENKINS-70155] ReadTrusted fails when using Pipeline from SCM with a specific commit / Lightweight checkout fails when specifying single commit

Open
#540 5 comments 0 reactions 0 assignees View on GitHub
component:workflow-multibranch-plugin imported-jira-issue priority:minor resolution:unresolved
Dominant language
Java
Stars
87
Forks
131
PR merge metrics
No merged PRs in 30d

Description

We have a pipeline job that specifies a commit SHA as branch spec.

As described at plugin/job-dsl/api-viewer/index.html#path/pipelineJob-definition-cpsScm-scm-gitSCM-branches-branchSpec-name



  • Checks out the specified commit.E.g. 5062ac843f2b947733e6a3b105977056821bd3525062ac84, ...


 

This works as long as lightweight checkout is disabled, which means SCMFileSystem is not used. 

See here: https://github.com/jenkinsci/workflow-cps-plugin/blob/ef35de2396200112c03fd56359f7691a6de23dc3/plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/CpsScmFlowDefinition.java#L117 

When lightweight checkout is enabled the error described below happens. 


hudson.plugins.git.GitException: Command "git fetch --tags --force --progress --prune – origin +refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f:refs/remotes/origin/15b834bad5c89087e90b2dcee263ece1af328a9f" returned status code 128: stdout: stderr: fatal: couldn't find remote ref refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f


The same thing happens with readTrusted, which is used by the Kubernetes plugin to read yaml files and which actually sent me on this hunt.

Our pipeline job was always started correctly, the pipeline file was pulled from the right commit and then it failed to pull the yaml file with the error message shown above.

Fixing readTrusted can be done by specifying 


Dorg.jenkinsci.plugins.workflow.multibranch.SCMBinder.USE_HEAVYWEIGHT_CHECKOUT=true


To force it to not use SCMFileSystem.

This could be fixed more cleanly by having GitSCMFileSystem work with commits, but I am not sure how.

Another way would be to somehow change the supports() method to return false in case a commit is given.

https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L257

But I don't see a way to differentiate between a commit SHA and a branch name. 

The actual wrong behavior in all of this is happening here:

https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L404

instead of a proper ref the commit SHA will be used here.

 

The following two links describe the same symptoms and will probably be the same issue.

https://issue-redirect.jenkins.io/issue/60697

https://stackoverflow.com/questions/69116849/gerrit-refspec-not-recognized-during-scm-git-checkout-jenkinsfile-declarative 

---
Originally reported by codesuki, imported from: ReadTrusted fails when using Pipeline from SCM with a specific commit / Lightweight checkout fails when specifying single commit


  • status: Open
  • priority: Minor
  • component(s): workflow-multibranch-plugin
  • resolution: Unresolved
  • votes: 2
  • watchers: 6
  • imported: 20251212-090250

Raw content of original issue

We have a pipeline job that specifies a commit SHA as branch spec.

As described at plugin/job-dsl/api-viewer/index.html#path/pipelineJob-definition-cpsScm-scm-gitSCM-branches-branchSpec-name



  • <commitId>Checks out the specified commit.E.g. 5062ac843f2b947733e6a3b105977056821bd3525062ac84, ...


 

This works as long as lightweight checkout is disabled, which means SCMFileSystem is not used. 

See here: https://github.com/jenkinsci/workflow-cps-plugin/blob/ef35de2396200112c03fd56359f7691a6de23dc3/plugin/src/main/java/org/jenkinsci/plugins/workflow/cps/CpsScmFlowDefinition.java#L117 

When lightweight checkout is enabled the error described below happens. 


hudson.plugins.git.GitException: Command "git fetch --tags --force --progress --prune – origin +refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f:refs/remotes/origin/15b834bad5c89087e90b2dcee263ece1af328a9f" returned status code 128: stdout: stderr: fatal: couldn't find remote ref refs/heads/15b834bad5c89087e90b2dcee263ece1af328a9f


The same thing happens with readTrusted, which is used by the Kubernetes plugin to read yaml files and which actually sent me on this hunt.

Our pipeline job was always started correctly, the pipeline file was pulled from the right commit and then it failed to pull the yaml file with the error message shown above.

Fixing readTrusted can be done by specifying 


Dorg.jenkinsci.plugins.workflow.multibranch.SCMBinder.USE_HEAVYWEIGHT_CHECKOUT=true


To force it to not use SCMFileSystem.

This could be fixed more cleanly by having GitSCMFileSystem work with commits, but I am not sure how.

Another way would be to somehow change the supports() method to return false in case a commit is given.

https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L257

But I don't see a way to differentiate between a commit SHA and a branch name. 

The actual wrong behavior in all of this is happening here:
https://github.com/jenkinsci/git-plugin/blob/master/src/main/java/jenkins/plugins/git/GitSCMFileSystem.java#L404

instead of a proper ref the commit SHA will be used here.

 

The following two links describe the same symptoms and will probably be the same issue.

https://issues.jenkins.io/browse/JENKINS-60697

https://stackoverflow.com/questions/69116849/gerrit-refspec-not-recognized-during-scm-git-checkout-jenkinsfile-declarative 

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.