test

pom.xml

@@ -4,7 +4,7 @@
   <parent>
     <groupId>org.jenkins-ci.plugins</groupId>
     <artifactId>plugin</artifactId>
-    <version>4.86</version>
+    <version>5.9</version>
     <relativePath />
   </parent>
 
@@ -33,7 +33,9 @@
     <changelist>999999-SNAPSHOT</changelist>
     <gitHubRepo>jenkinsci/${project.artifactId}-plugin</gitHubRepo>
     <hpi.compatibleSinceVersion>2.2.0</hpi.compatibleSinceVersion>
-    <jenkins.version>2.440.3</jenkins.version>
+    <!-- https://www.jenkins.io/doc/developer/plugin-development/choosing-jenkins-baseline/ -->
+    <jenkins.baseline>2.479</jenkins.baseline>
+    <jenkins.version>${jenkins.baseline}.1</jenkins.version>
     <useBeta>true</useBeta>
     <spotless.check.skip>false</spotless.check.skip>
   </properties>
@@ -42,8 +44,8 @@
     <dependencies>
       <dependency>
         <groupId>io.jenkins.tools.bom</groupId>
-        <artifactId>bom-2.440.x</artifactId>
-        <version>3234.v5ca_5154341ef</version>
+        <artifactId>bom-${jenkins.baseline}.x</artifactId>
+        <version>3893.v213a_42768d35</version>
         <type>pom</type>
         <scope>import</scope>
       </dependency>

src/main/java/org/jenkinsci/plugins/github_branch_source/ApiRateLimitChecker.java

@@ -1,7 +1,6 @@
 package org.jenkinsci.plugins.github_branch_source;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Util;
 import hudson.model.TaskListener;
 import hudson.util.LogTaskListener;
@@ -18,7 +17,6 @@
 import org.kohsuke.github.GitHub;
 import org.kohsuke.github.RateLimitChecker;
 
-@SuppressFBWarnings("DMI_RANDOM_USED_ONLY_ONCE") // https://github.com/spotbugs/spotbugs/issues/1539
 public enum ApiRateLimitChecker {
 
     /** Attempt to evenly distribute GitHub API requests. */

src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java

@@ -295,23 +295,22 @@ public static StandardCredentials lookupScanCredentials(
             @CheckForNull String repoOwner) {
         if (Util.fixEmpty(scanCredentialsId) == null) {
             return null;
-        } else {
-            StandardCredentials c = CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentials(
-                            StandardUsernameCredentials.class,
-                            context,
-                            context instanceof Queue.Task
-                                    ? ((Queue.Task) context).getDefaultAuthentication()
-                                    : ACL.SYSTEM,
-                            githubDomainRequirements(apiUri)),
-                    CredentialsMatchers.allOf(
-                            CredentialsMatchers.withId(scanCredentialsId), githubScanCredentialsMatcher()));
-            if (c instanceof GitHubAppCredentials && repoOwner != null) {
-                return ((GitHubAppCredentials) c).withOwner(repoOwner);
-            } else {
-                return c;
-            }
         }
+        StandardCredentials c = CredentialsMatchers.firstOrNull(
+                CredentialsProvider.lookupCredentialsInItem(
+                        StandardUsernameCredentials.class,
+                        context,
+                        context instanceof Queue.Task
+                                ? ((Queue.Task) context).getDefaultAuthentication2()
+                                : ACL.SYSTEM2,
+                        githubDomainRequirements(apiUri)),
+                CredentialsMatchers.allOf(
+                        CredentialsMatchers.withId(scanCredentialsId), githubScanCredentialsMatcher()));
+
+        if (c instanceof GitHubAppCredentials && repoOwner != null) {
+            c = ((GitHubAppCredentials) c).withOwner(repoOwner);
+        }
+        return c;
     }
 
     /**

src/main/java/org/jenkinsci/plugins/github_branch_source/FillErrorResponse.java

@@ -1,13 +1,12 @@
 package org.jenkinsci.plugins.github_branch_source;
 
 import hudson.Util;
+import jakarta.servlet.http.HttpServletResponse;
 import java.io.IOException;
-import javax.servlet.ServletException;
-import javax.servlet.http.HttpServletResponse;
 import jenkins.model.Jenkins;
 import org.kohsuke.stapler.HttpResponse;
-import org.kohsuke.stapler.StaplerRequest;
-import org.kohsuke.stapler.StaplerResponse;
+import org.kohsuke.stapler.StaplerRequest2;
+import org.kohsuke.stapler.StaplerResponse2;
 
 // TODO replace with corresponding core functionality once Jenkins core has JENKINS-42443
 class FillErrorResponse extends IOException implements HttpResponse {
@@ -20,8 +19,7 @@ public FillErrorResponse(String message, boolean clearList) {
     }
 
     @Override
-    public void generateResponse(StaplerRequest req, StaplerResponse rsp, Object node)
-            throws IOException, ServletException {
+    public void generateResponse(StaplerRequest2 req, StaplerResponse2 rsp, Object node) throws IOException {
         rsp.setStatus(HttpServletResponse.SC_INTERNAL_SERVER_ERROR);
         rsp.setContentType("text/html;charset=UTF-8");
         rsp.setHeader("X-Jenkins-Select-Error", clearList ? "clear" : "retain");

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java

@@ -82,7 +82,6 @@ public class GitHubAppCredentials extends BaseStandardCredentials implements Sta
 
     private String apiUri;
 
-    @SuppressFBWarnings(value = "IS2_INCONSISTENT_SYNC", justification = "#withOwner locking only for #byOwner")
     private String owner;
 
     private transient AppInstallationToken cachedToken;
@@ -498,7 +497,7 @@ long getTokenStaleEpochSeconds() {
      *   <li>The agent need not be able to contact GitHub.
      * </ul>
      */
-    private Object writeReplace() {
+    protected Object writeReplace() {
         if (
         /* XStream */ Channel.current() == null) {
             return this;

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubConfiguration.java

@@ -42,7 +42,7 @@
 import jenkins.model.Jenkins;
 import net.sf.json.JSONObject;
 import org.apache.commons.lang.StringUtils;
-import org.kohsuke.stapler.StaplerRequest;
+import org.kohsuke.stapler.StaplerRequest2;
 
 @Extension
 public class GitHubConfiguration extends GlobalConfiguration {
@@ -60,7 +60,7 @@ public GitHubConfiguration() {
     }
 
     @Override
-    public boolean configure(StaplerRequest req, JSONObject json) throws FormException {
+    public boolean configure(StaplerRequest2 req, JSONObject json) throws FormException {
         req.bindJSON(this, json);
         return true;
     }

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubOrgMetadataAction.java

@@ -76,7 +76,7 @@ public String getAvatarImageOf(String size) {
             String image = avatarIconClassNameImageOf(getAvatarIconClassName(), size);
             return image != null
                     ? image
-                    : (Stapler.getCurrentRequest().getContextPath()
+                    : (Stapler.getCurrentRequest2().getContextPath()
                             + Hudson.RESOURCE_PATH
                             + "/plugin/github-branch-source/images/"
                             + "/github-logo.svg");

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMBuilder.java

@@ -32,7 +32,6 @@
 import com.cloudbees.plugins.credentials.domains.URIRequirementBuilder;
 import edu.umd.cs.findbugs.annotations.CheckForNull;
 import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.model.Item;
 import hudson.model.Queue;
 import hudson.plugins.git.GitSCM;
@@ -59,7 +58,6 @@
  *
  * @since 2.2.0
  */
-@SuppressFBWarnings("DMI_RANDOM_USED_ONLY_ONCE") // https://github.com/spotbugs/spotbugs/issues/1539
 public class GitHubSCMBuilder extends GitSCMBuilder<GitHubSCMBuilder> {
 
     private static final Random ENTROPY = new Random();
@@ -124,7 +122,6 @@ public GitHubSCMBuilder(
         if (repoUrl != null) {
             withBrowser(new GithubWeb(repoUrl));
         }
-        withCredentials(credentialsId(), null);
     }
 
     /**
@@ -189,7 +186,9 @@ public final RepositoryUriResolver uriResolver() {
      *     {@code null} to detect the the protocol based on the credentialsId. Defaults to HTTP if
      *     credentials are {@code null}. Enables support for blank SSH credentials.
      * @return {@code this} for method chaining.
+     * @deprecated Use {@link #withCredentials(String)} and {@link #withResolver(RepositoryUriResolver)}
      */
+    @Deprecated
     @NonNull
     public GitHubSCMBuilder withCredentials(String credentialsId, RepositoryUriResolver uriResolver) {
         if (uriResolver == null) {
@@ -200,6 +199,12 @@ public GitHubSCMBuilder withCredentials(String credentialsId, RepositoryUriResol
         return withCredentials(credentialsId);
     }
 
+    @NonNull
+    public GitHubSCMBuilder withResolver(RepositoryUriResolver uriResolver) {
+        this.uriResolver = uriResolver;
+        return this;
+    }
+
     /**
      * Returns a {@link RepositoryUriResolver} according to credentials configuration.
      *
@@ -215,12 +220,12 @@ public static RepositoryUriResolver uriResolver(
             return HTTPS;
         } else {
             StandardCredentials credentials = CredentialsMatchers.firstOrNull(
-                    CredentialsProvider.lookupCredentials(
+                    CredentialsProvider.lookupCredentialsInItem(
                             StandardCredentials.class,
                             context,
                             context instanceof Queue.Task
-                                    ? ((Queue.Task) context).getDefaultAuthentication()
-                                    : ACL.SYSTEM,
+                                    ? ((Queue.Task) context).getDefaultAuthentication2()
+                                    : ACL.SYSTEM2,
                             URIRequirementBuilder.create()
                                     .withHostname(RepositoryUriResolver.hostnameFromApiUri(apiUri))
                                     .build()),

src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMNavigator.java

@@ -211,6 +211,9 @@ public class GitHubSCMNavigator extends SCMNavigator {
     private transient Boolean buildForkPRHead;
 
     private static final LoadingCache<String, Boolean> privateModeCache = createPrivateModeCache();
+    /** The cache of the credentials object */
+    @CheckForNull
+    private transient volatile StandardCredentials credentials;
 
     /**
      * Constructor.
@@ -252,6 +255,15 @@ public GitHubSCMNavigator(String apiUri, String repoOwner, String scanCredential
         }
     }
 
+    @CheckForNull
+    @Restricted(NoExternalUse.class)
+    private StandardCredentials getCredentials(@CheckForNull Item context, boolean forceRefresh) {
+        if (credentials == null || forceRefresh) {
+            credentials = Connector.lookupScanCredentials(context, getApiUri(), getCredentialsId(), getRepoOwner());
+        }
+        return credentials;
+    }
+
     /**
      * Gets the API endpoint for the GitHub server.
      *
@@ -962,9 +974,7 @@ public void visitSources(SCMSourceObserver observer) throws IOException, Interru
             throw new AbortException("Must specify user or organization");
         }
 
-        StandardCredentials credentials =
-                Connector.lookupScanCredentials((Item) observer.getContext(), apiUri, credentialsId, repoOwner);
-
+        StandardCredentials credentials = getCredentials(observer.getContext(), true);
         // Github client and validation
         GitHub github = Connector.connect(apiUri, credentials);
         try {
@@ -1278,9 +1288,7 @@ public void visitSource(String sourceName, SCMSourceObserver observer) throws IO
             throw new AbortException("Must specify user or organization");
         }
 
-        StandardCredentials credentials =
-                Connector.lookupScanCredentials((Item) observer.getContext(), apiUri, credentialsId, repoOwner);
-
+        StandardCredentials credentials = getCredentials(observer.getContext(), false);
         // Github client and validation
         GitHub github;
         try {
@@ -1544,9 +1552,7 @@ public List<Action> retrieveActions(
         listener.getLogger().printf("Looking up details of %s...%n", getRepoOwner());
         List<Action> result = new ArrayList<>();
         String apiUri = Util.fixEmptyAndTrim(getApiUri());
-        StandardCredentials credentials =
-                Connector.lookupScanCredentials((Item) owner, getApiUri(), credentialsId, repoOwner);
-        GitHub hub = Connector.connect(getApiUri(), credentials);
+        GitHub hub = Connector.connect(getApiUri(), getCredentials(owner, true));
         Connector.configureLocalRateLimitChecker(listener, hub);
         boolean privateMode = !isEnableAvatar() || determinePrivateMode(apiUri);
         try {
@@ -1642,9 +1648,7 @@ public void afterSave(@NonNull SCMNavigatorOwner owner) {
         GitHubWebHook.get().registerHookFor(owner);
         try {
             // FIXME MINOR HACK ALERT
-            StandardCredentials credentials =
-                    Connector.lookupScanCredentials((Item) owner, getApiUri(), credentialsId, repoOwner);
-            GitHub hub = Connector.connect(getApiUri(), credentials);
+            GitHub hub = Connector.connect(getApiUri(), getCredentials(owner, true));
             try {
                 GitHubOrgWebHook.register(hub, repoOwner);
             } finally {
@@ -1984,6 +1988,7 @@ public SourceFactory(GitHubSCMNavigatorRequest request) {
         public SCMSource create(@NonNull String name) {
             return new GitHubSCMSourceBuilder(getId() + "::" + name, apiUri, credentialsId, repoOwner, name)
                     .withRequest(request)
+                    .withCredentials(credentials)
                     .build();
         }
     }