{"record":{"id":"b7e13a3f17b47961","repo":"theonedev/onedev","slug":"code-read-permission-is-required-to-import-build-s","errorCode":null,"errorMessage":"Code read permission is required to import build spec (import project: {0}, import revision: {1})","messagePattern":"Code read permission is required to import build spec \\(import project: (.+?), import revision: (.+?)\\)","errorType":"exception","errorClass":"ExplicitException","httpStatus":null,"severity":"error","filePath":"server-core/src/main/java/io/onedev/server/buildspec/Import.java","lineNumber":170,"sourceCode":"\tpublic BuildSpec getBuildSpec() {\n\t\tif (buildSpec == null) {\n\t\t\tProject project = getProject();\n\n\t\t\tSubject subject;\n\t\t\ttry {\n\t\t\t\tsubject = JobAuthorizationContext.get().getSubject(getAccessTokenSecret());\n\t\t\t} catch (ExplicitException e) {\n\t\t\t\tvar errorMessage = MessageFormat.format(\n\t\t\t\t\t\t_T(\"Unable to import build spec (import project: {0}, import revision: {1}): {2}\"),\n\t\t\t\t\t\tprojectPath, revision, e.getMessage());\n\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t}\n\t\t\tif (!subject.isPermitted(new ProjectPermission(project, new ReadCode())) \n\t\t\t\t\t&& !project.isPermittedByLoginUser(new ReadCode())) {\n\t\t\t\tString errorMessage = MessageFormat.format(\n\t\t\t\t\t\t_T(\"Code read permission is required to import build spec (import project: {0}, import revision: {1})\"), \n\t\t\t\t\t\tprojectPath, revision);\n\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t}\n\t\t\t\n\t\t\tRevCommit commit = getCommit();\n\t\t\ttry {\n\t\t\t\tbuildSpec = project.getBuildSpec(commit);\n\t\t\t} catch (BuildSpecParseException e) {\n\t\t\t\tString errorMessage = MessageFormat.format(\n\t\t\t\t\t\t_T(\"Malformed build spec (import project: {0}, import revision: {1})\"), \n\t\t\t\t\t\tprojectPath, revision);\n\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t}\n\t\t\tif (buildSpec == null) {\n\t\t\t\tString errorMessage = MessageFormat.format(\n\t\t\t\t\t\t_T(\"Build spec not defined (import project: {0}, import revision: {1})\"), \n\t\t\t\t\t\tprojectPath, revision);\n\t\t\t\tthrow new ExplicitException(errorMessage);\n\t\t\t}\n\t\t\t","sourceCodeStart":152,"sourceCodeEnd":188,"githubUrl":"https://github.com/theonedev/onedev/blob/d44925c47c37992c828ea673a5f9620539bc3ff2/server-core/src/main/java/io/onedev/server/buildspec/Import.java#L152-L188","documentation":"Import.getBuildSpec requires the importing subject (job token subject or login user) to have ReadCode permission on the imported project. If neither the token subject nor the login user is permitted, it throws ExplicitException 'Code read permission is required to import build spec (import project: X, import revision: Y)'.","triggerScenarios":"A job in project A imports the build spec of project B using a job authorization token whose subject lacks ProjectPermission ReadCode on B, and no login user grants it either; thrown during getBuildSpec().","commonSituations":"Cross-project build spec imports between projects with isolated permissions; job tokens scoped to their own project only; guest-role users or unauthenticated jobs importing restricted projects; project permissions tightened after the import was configured.","solutions":["Grant the job token's subject ReadCode permission on the imported project (Project Partners / job authorization settings)","Use a job secret containing a project access token from the imported project that has code-read rights","Run the importing job as a login user with ReadCode on the target project, if applicable","If the import is no longer needed, remove the Import node from the build spec"],"exampleFix":"// before: job token limited to own project, import of 'other/project' fails\n// after: in project 'other/project' settings, grant the job's token subject\n// ProjectPermission(name='other/project', privilege=ReadCode), or supply a\n// dedicated access-token secret with code-read access to that project","handlingStrategy":"try-catch","validationCode":"// before configuring the import, confirm the token subject can read the project:\n// subject.isPermitted(new ProjectPermission(project, new ReadCode()))","typeGuard":null,"tryCatchPattern":"try {\n    BuildSpec imported = import_.getBuildSpec();\n} catch (ExplicitException e) {\n    // 'Code read permission is required...' -> grant ReadCode or use a suitable token\n}","preventionTips":["Grant job authorization subjects ReadCode on imported projects","Use project access tokens from the imported project for cross-project imports","Re-check permissions after tightening project security","Document which tokens each project import relies on"],"tags":["buildspec","import","permissions","authorization"],"backgroundTag":"permission-denied","analyzedSha":"d44925c47c37992c828ea673a5f9620539bc3ff2","analyzedAt":"2026-09-06T07:18:27.995Z","contentChangedAt":"2026-09-06T07:18:27.995Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}