theonedev/onedev · error · ExplicitException

This build is not authorized to sync to project:

Error message

This build is not authorized to sync to project: 

What it means

PullRepositoryStep syncs a repository checkout into a target project during a build. Before doing so it verifies authorization: either the build's job token grants access, or an access token secret is set whose token owner can manage the target project. If neither check passes, an ExplicitException is thrown naming the target project path.

Source

Thrown at server-core/src/main/java/io/onedev/server/buildspec/step/PullRepository.java:161

			Project project = build.getProject();
			Project targetProject;
			if (getTargetProject() != null) {
				targetProject = getProjectService().findByPath(getTargetProject());
				if (targetProject == null)
					throw new ExplicitException("Target project not found: " + getTargetProject());
			} else {
				targetProject = project;
			}
			boolean authorized = false;
			if (project.isCommitOnBranch(build.getCommitId(), project.getDefaultBranch()) 
					&& project.isSelfOrAncestorOf(targetProject)) {
				authorized = true;
			} else if (getAccessTokenSecret() != null && 
					SecurityUtils.canManageProject(build.getAccessToken(getAccessTokenSecret()).asSubject(), targetProject)) {
				authorized = true;
			}
			if (!authorized) 
				throw new ExplicitException("This build is not authorized to sync to project: " + targetProject.getPath());

			Long userId;
			if (getAccessTokenSecret() != null) {
				userId = build.getAccessToken(getAccessTokenSecret()).getOwner().getId();
			} else {
				userId = User.SYSTEM_ID;
			}

			String remoteUrl = getRemoteUrlWithCredential(build);
			Long targetProjectId = targetProject.getId();
			var task = new PullTask(targetProjectId, userId, remoteUrl, getCertificate(), getRefs(), isForce(), isWithLfs(), getProxy(), build.getSecretMasker());
			getProjectService().runOnActiveServer(targetProjectId, task);
			return new ServerStepResult(true);
		});
	}
	
	private static ProjectService getProjectService() {
		return OneDev.getInstance(ProjectService.class);

View on GitHub (pinned to d44925c47c)

Solutions

1. Set the step's accessTokenSecret to a job secret holding an access token whose owner can manage the target project.
2. Grant the token owner 'Manage Project' permission on the target project in Project > Access Management.
3. If same-project sync, ensure the job token is permitted for that project (check job authorization settings).
4. Verify the target project path is correct and the project still exists.

Example fix

// before
- type: PullRepository
  targetProjectPath: other/project
// after
- type: PullRepository
  targetProjectPath: other/project
  accessTokenSecret: cross-project-token

// Java: check authorization before adding PullRepositoryStep
var tokenOwner = build.getAccessToken(getAccessTokenSecret()).asSubject();
if (getAccessTokenSecret() == null && !jobTokenAuthorized
        || (getAccessTokenSecret() != null && !SecurityUtils.canManageProject(tokenOwner, targetProject))) {
    throw new ExplicitException("Grant manage permission on " + targetProject.getPath() + " to the access token owner");
}

When it happens

Trigger: Calling PullRepositoryStep.run when getAccessTokenSecret() is null and the build's job token does not authorize the target project, or when the access token's owner lacks manage permission (SecurityUtils.canManageProject false) on targetProject.

Common situations: Build spec references another project's repository without an access token secret configured; the access token belongs to a user who is not a project manager; job token scoping restricts the build to its own project; project was renamed/moved so the referenced path differs from what the token can access.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

• Loopback address not allowed for target docker image of push
• Step template not found:
• Error validating build spec (project: %s, commit: %s, locati
• Build spec not defined (project: %s, commit: %s)
• Unable to access dependency project '" + dependency.getProje

AI-assisted analysis of theonedev/onedev@d44925c47c (2026-09-06). Data as JSON: /api/errors/638d3135fd5e0f34. Report an issue: GitHub.