theonedev/onedev · error · ExplicitException

No authorized job secret found (project: {0}, job secret: {1

Error message

No authorized job secret found (project: {0}, job secret: {1})

What it means

Thrown by JobAuthorizationContext.getSecretValue when a named job secret exists in the project hierarchy but its authorization job match rejects the current context (or no secret with that name is authorized anywhere in the hierarchy). The job is therefore not allowed to read the secret value. Thrown as ExplicitException with project path and secret name.

Source

Thrown at server-core/src/main/java/io/onedev/server/job/JobAuthorizationContext.java:104

							if (project.equals(request.getSourceProject())) {
								JobMatchContext sourceMatchContext = new JobMatchContext(project, request.getSourceBranch(), null, null);
								JobMatchContext targetMatchContext = new JobMatchContext(project, request.getTargetBranch(), null, null);
								if (jobMatch.matches(sourceMatchContext) && jobMatch.matches(targetMatchContext))
									return normalizeSecretValue(secret.getValue());
							} else {
								JobMatchContext matchContext = new JobMatchContext(project, null, commitId, null);
								if (jobMatch.matches(matchContext))
									return normalizeSecretValue(secret.getValue());
							}
						} else {
							JobMatchContext matchContext = new JobMatchContext(project, null, commitId, null);
							if (jobMatch.matches(matchContext))
								return normalizeSecretValue(secret.getValue());
						}
					}
				}
			}
			throw new ExplicitException(MessageFormat.format(
					_T("No authorized job secret found (project: {0}, job secret: {1})"),
					project.getPath(), secretName));
		}
	}
	
	private String normalizeSecretValue(String secretValue) {
		return secretValue.replace("\r\n", "\n");
	}

	public static void push(JobAuthorizationContext jobAuthorizationContext) {
		stack.get().push(jobAuthorizationContext);
	}

	public static void pop() {
		stack.get().pop();
	}

	@org.jspecify.annotations.Nullable

View on GitHub (pinned to d44925c47c)

Solutions

1. Review the secret's Authorization job match and widen it to include the current branch/commit/project
2. Check the job runs on a branch covered by the secret's restrictions
3. For fork PRs, either disallow secret access or define a separate authorized secret
4. Verify the secret name spelling and that it exists in the project or parent projects

Example fix

// before: authorization restricted to main only
// authorization: "on branch main"
// after: allow release branches too
// authorization: "on branch main or on branch release/*"

// ensure the secret's authorization covers the current branch/project
// authorization example: "on branch main or on branch release/*"

try {
    String value = authContext.getSecretValue(secretName);
} catch (ExplicitException e) {
    // fail pipeline with guidance to fix secret authorization
}

When it happens

Trigger: A job secret defines an authorization job match (branch/commit/project conditions) that does not match the current build context: wrong branch, unauthorized source project in a pull request, or commit not matching, so no authorized secret value is returned.

Common situations: Secret restricted to branch 'main' but job runs on a feature branch; fork PRs cannot access secrets because request.getSourceProject() differs; secret name typo causing no match in hierarchy; recently tightened authorization rules breaking existing pipelines.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Job name not available in match context
• This build is not authorized to sync to project:
• Malformed job match
• Unexpected operator: " + ctx.operator.getText()
• Project criteria is not supported here

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/95490ebcc63ac906. Report an issue: GitHub.