theonedev/onedev · warning · BlobEditException

Build required for this change. Please submit pull request i

Error message

Build required for this change. Please submit pull request instead

What it means

When saving a blob edit, ProjectBlobPage calls Project.isBuildRequiredForModification; if branch protection requires a successful build before modifying the path, a BlobEditException tells the user to submit a pull request so CI can validate the change.

Source

Thrown at server-core/src/main/java/io/onedev/server/web/page/project/blob/ProjectBlobPage.java:1635

		User user = Preconditions.checkNotNull(SecurityUtils.getAuthUser());
		BlobIdent blobIdent = getBlobIdent();
		
		boolean signRequired = false;
		for (var item: upload.getItems()) {
			String blobPath = FilenameUtils.sanitizeFileName(FileUpload.getFileName(item));
			if (parentPath != null)
				blobPath = parentPath + "/" + blobPath;
			var blobType = FileExtension.getExtension(blobPath);

			var disallowedFileTypes = getProject().getBranchProtection(blobIdent.revision, user).getDisallowedFileTypes();
			if (disallowedFileTypes.stream().anyMatch(type -> type.equalsIgnoreCase(blobType))) {
				throw new BlobEditException(MessageFormat.format(_T("Not allowed file type: {0}"), blobType));
			}

			if (getProject().isReviewRequiredForModification(user, blobIdent.revision, blobPath)) 
				throw new BlobEditException(_T("Review required for this change. Please submit pull request instead"));
			else if (getProject().isBuildRequiredForModification(user, blobIdent.revision, blobPath)) 
				throw new BlobEditException(_T("Build required for this change. Please submit pull request instead"));
			else if (getProject().isCommitSignatureRequiredButNoSigningKey(user, blobIdent.revision)) 
				signRequired = true;
			
			BlobContent blobContent = new BlobContent(item.get(), FileMode.REGULAR_FILE.getBits());
			newBlobs.put(blobPath, blobContent);
		}

		BlobEdits blobEdits = new BlobEdits(Sets.newHashSet(), newBlobs);
		String refName = blobIdent.revision!=null? GitUtils.branch2ref(blobIdent.revision):"refs/heads/main";

		ObjectId prevCommitId;
		if (blobIdent.revision != null)
			prevCommitId = getProject().getRevCommit(blobIdent.revision, true).copy();
		else
			prevCommitId = ObjectId.zeroId();

		while (true) {
			try {

View on GitHub (pinned to d44925c47c)

Solutions

Submit a pull request from a feature branch so the required build runs on it
Ensure the target branch's latest commit has a successful build if direct commits are otherwise allowed
Relax the build-required rule in branch protection if inappropriate

Example fix

// before: web-edit file directly on protected main with build requirement
// after: branch feature/x -> edit -> push -> CI runs -> open PR

Defensive patterns

Strategy: validation

Validate before calling

if (project.isBuildRequiredForModification(user, revision, path)) {
    // require PR flow so CI validates the change
}

Try / catch

try {
    saveBlob();
} catch (BlobEditException e) {
    offerPullRequestWorkflow();
}

Prevention

Ensure branch has a green build before direct edits if build-required is on
Prefer PRs on branches with build requirements
Review branch protection CI rules before editing

When it happens

Trigger: Direct web-editor commit to a branch whose protection has a build requirement (successful CI build needed) for the changed path or revision.

Common situations: Editing files on main where 'build required for modification' is enabled; the last commit on the branch has no successful build.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/0da1be14d649ad27. Report an issue: GitHub.