{"record":{"id":"95490ebcc63ac906","repo":"theonedev/onedev","slug":"no-authorized-job-secret-found-project-0-job","errorCode":null,"errorMessage":"No authorized job secret found (project: {0}, job secret: {1})","messagePattern":"No authorized job secret found \\(project: (.+?), job secret: (.+?)\\)","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java","lineNumber":104,"sourceCode":"\t\t\t\t\t\t\tif (project.equals(request.getSourceProject())) {\n\t\t\t\t\t\t\t\tJobMatchContext sourceMatchContext = new JobMatchContext(project, request.getSourceBranch(), null, null);\n\t\t\t\t\t\t\t\tJobMatchContext targetMatchContext = new JobMatchContext(project, request.getTargetBranch(), null, null);\n\t\t\t\t\t\t\t\tif (jobMatch.matches(sourceMatchContext) && jobMatch.matches(targetMatchContext))\n\t\t\t\t\t\t\t\t\treturn normalizeSecretValue(secret.getValue());\n\t\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\t\tJobMatchContext matchContext = new JobMatchContext(project, null, commitId, null);\n\t\t\t\t\t\t\t\tif (jobMatch.matches(matchContext))\n\t\t\t\t\t\t\t\t\treturn normalizeSecretValue(secret.getValue());\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t} else {\n\t\t\t\t\t\t\tJobMatchContext matchContext = new JobMatchContext(project, null, commitId, null);\n\t\t\t\t\t\t\tif (jobMatch.matches(matchContext))\n\t\t\t\t\t\t\t\treturn normalizeSecretValue(secret.getValue());\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\tthrow new ExplicitException(MessageFormat.format(\n\t\t\t\t\t_T(\"No authorized job secret found (project: {0}, job secret: {1})\"),\n\t\t\t\t\tproject.getPath(), secretName));\n\t\t}\n\t}\n\t\n\tprivate String normalizeSecretValue(String secretValue) {\n\t\treturn secretValue.replace(\"\\r\\n\", \"\\n\");\n\t}\n\n\tpublic static void push(JobAuthorizationContext jobAuthorizationContext) {\n\t\tstack.get().push(jobAuthorizationContext);\n\t}\n\n\tpublic static void pop() {\n\t\tstack.get().pop();\n\t}\n\n\t@org.jspecify.annotations.Nullable","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java#L86-L122","documentation":"Thrown by JobAuthorizationContext.getSecretValue when a named job secret exists in the project hierarchy but its authorization job match rejects the current context (or no secret with that name is authorized anywhere in the hierarchy). The job is therefore not allowed to read the secret value. Thrown as ExplicitException with project path and secret name.","triggerScenarios":"A job secret defines an authorization job match (branch/commit/project conditions) that does not match the current build context: wrong branch, unauthorized source project in a pull request, or commit not matching, so no authorized secret value is returned.","commonSituations":"Secret restricted to branch 'main' but job runs on a feature branch; fork PRs cannot access secrets because request.getSourceProject() differs; secret name typo causing no match in hierarchy; recently tightened authorization rules breaking existing pipelines.","solutions":["Review the secret's Authorization job match and widen it to include the current branch/commit/project","Check the job runs on a branch covered by the secret's restrictions","For fork PRs, either disallow secret access or define a separate authorized secret","Verify the secret name spelling and that it exists in the project or parent projects"],"exampleFix":"// before: authorization restricted to main only\n// authorization: \"on branch main\"\n// after: allow release branches too\n// authorization: \"on branch main or on branch release/*\"","handlingStrategy":"validation","validationCode":"// ensure the secret's authorization covers the current branch/project\n// authorization example: \"on branch main or on branch release/*\"","typeGuard":null,"tryCatchPattern":"try {\n    String value = authContext.getSecretValue(secretName);\n} catch (ExplicitException e) {\n    // fail pipeline with guidance to fix secret authorization\n}","preventionTips":["Keep secret authorization expressions aligned with the branches that run jobs","Decide explicitly how fork PRs access (or cannot access) secrets","Document secret authorization rules for the team"],"tags":["secrets","authorization","ci","job-match"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}