Fix ClassCastException when SCMSource is not GitHubSCMSource

kovalevsky · kovalevsky · commit 0f52791f62d6 · 2026-02-26T21:26:06.000+04:00
The getKey() method in IssueCommentTrigger, LabelAddedTrigger, and
PullRequestReviewTrigger performs an unsafe cast of the result of
SCMSource.SourceByItem.findSource() to GitHubSCMSource. This throws
a ClassCastException when the source is a NullSCMSource (or any other
non-GitHub SCM source).

This happens during the stop()/start() cycle triggered by
MultiBranchProject.processHeadUpdate() when a push event causes
BranchProjectFactory.decorate() to call stopTriggers(). The exception
in stop() prevents the trigger from being re-registered in start(),
silently removing the job from the DescriptorImpl.jobs map. Subsequent
webhook events for that PR are then silently ignored because the key
lookup returns an empty set.

The fix adds instanceof checks before casting in getKey(), returning
null when the source is not a GitHubSCMSource, and guards callers in
start() and stop() against null keys. A warning is logged to help
diagnose similar issues in the future.
diff --git a/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/IssueCommentTrigger.java b/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/IssueCommentTrigger.java
@@ -1,7 +1,6 @@
 package org.jenkinsci.plugins.pipeline.github.trigger;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Item;
 import hudson.triggers.Trigger;
@@ -46,29 +45,42 @@ public void start(final WorkflowJob project, final boolean newInstance) {
         super.start(project, newInstance);
         // we only care about pull requests
         if (SCMHead.HeadByItem.findHead(project) instanceof PullRequestSCMHead) {
-            DescriptorImpl.jobs
-                    .computeIfAbsent(getKey(project), key -> new HashSet<>())
-                    .add(project);
+            final String key = getKey(project);
+            if (key != null) {
+                DescriptorImpl.jobs
+                        .computeIfAbsent(key, k -> new HashSet<>())
+                        .add(project);
+            }
         }
     }
 
     @Override
     public void stop() {
         if (SCMHead.HeadByItem.findHead(job) instanceof PullRequestSCMHead) {
-            DescriptorImpl.jobs.getOrDefault(getKey(job), Collections.emptySet())
-                    .remove(job);
+            final String key = getKey(job);
+            if (key != null) {
+                DescriptorImpl.jobs.getOrDefault(key, Collections.emptySet())
+                        .remove(job);
+            }
         }
     }
 
-    @SuppressFBWarnings("NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE")
     private String getKey(final WorkflowJob project) {
-        final GitHubSCMSource scmSource = (GitHubSCMSource) SCMSource.SourceByItem.findSource(project);
-        final PullRequestSCMHead scmHead = (PullRequestSCMHead) SCMHead.HeadByItem.findHead(project);
+        final SCMSource scmSource = SCMSource.SourceByItem.findSource(project);
+        if (!(scmSource instanceof GitHubSCMSource)) {
+            LOG.warn("Job: {} has a non-GitHub SCM source: {}, skipping trigger registration",
+                    project.getFullName(), scmSource != null ? scmSource.getClass().getName() : "null");
+            return null;
+        }
+        final SCMHead scmHead = SCMHead.HeadByItem.findHead(project);
+        if (!(scmHead instanceof PullRequestSCMHead)) {
+            return null;
+        }
 
         return String.format("%s/%s/%d",
-                scmSource.getRepoOwner(),
-                scmSource.getRepository(),
-                scmHead.getNumber()).toLowerCase();
+                ((GitHubSCMSource) scmSource).getRepoOwner(),
+                ((GitHubSCMSource) scmSource).getRepository(),
+                ((PullRequestSCMHead) scmHead).getNumber()).toLowerCase();
     }
 
     public String getCommentPattern() {
diff --git a/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/LabelAddedTrigger.java b/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/LabelAddedTrigger.java
@@ -1,7 +1,6 @@
 package org.jenkinsci.plugins.pipeline.github.trigger;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Item;
 import hudson.triggers.Trigger;
@@ -46,29 +45,42 @@ public void start(final WorkflowJob project, final boolean newInstance) {
         super.start(project, newInstance);
         // we only care about pull requests
         if (SCMHead.HeadByItem.findHead(project) instanceof PullRequestSCMHead) {
-            DescriptorImpl.jobs
-                    .computeIfAbsent(getKey(project), key -> new HashSet<>())
-                    .add(project);
+            final String key = getKey(project);
+            if (key != null) {
+                DescriptorImpl.jobs
+                        .computeIfAbsent(key, k -> new HashSet<>())
+                        .add(project);
+            }
         }
     }
 
     @Override
     public void stop() {
         if (SCMHead.HeadByItem.findHead(job) instanceof PullRequestSCMHead) {
-            DescriptorImpl.jobs.getOrDefault(getKey(job), Collections.emptySet())
-                    .remove(job);
+            final String key = getKey(job);
+            if (key != null) {
+                DescriptorImpl.jobs.getOrDefault(key, Collections.emptySet())
+                        .remove(job);
+            }
         }
     }
 
-    @SuppressFBWarnings("NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE")
     private String getKey(final WorkflowJob project) {
-        final GitHubSCMSource scmSource = (GitHubSCMSource) SCMSource.SourceByItem.findSource(project);
-        final PullRequestSCMHead scmHead = (PullRequestSCMHead) SCMHead.HeadByItem.findHead(project);
+        final SCMSource scmSource = SCMSource.SourceByItem.findSource(project);
+        if (!(scmSource instanceof GitHubSCMSource)) {
+            LOG.warn("Job: {} has a non-GitHub SCM source: {}, skipping trigger registration",
+                    project.getFullName(), scmSource != null ? scmSource.getClass().getName() : "null");
+            return null;
+        }
+        final SCMHead scmHead = SCMHead.HeadByItem.findHead(project);
+        if (!(scmHead instanceof PullRequestSCMHead)) {
+            return null;
+        }
 
         return String.format("%s/%s/%d",
-                scmSource.getRepoOwner(),
-                scmSource.getRepository(),
-                scmHead.getNumber()).toLowerCase();
+                ((GitHubSCMSource) scmSource).getRepoOwner(),
+                ((GitHubSCMSource) scmSource).getRepository(),
+                ((PullRequestSCMHead) scmHead).getNumber()).toLowerCase();
     }
 
     public String getLabelTrigger() {
diff --git a/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/PullRequestReviewTrigger.java b/src/main/java/org/jenkinsci/plugins/pipeline/github/trigger/PullRequestReviewTrigger.java
@@ -1,7 +1,6 @@
 package org.jenkinsci.plugins.pipeline.github.trigger;
 
 import edu.umd.cs.findbugs.annotations.NonNull;
-import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 import hudson.Extension;
 import hudson.model.Item;
 import hudson.triggers.Trigger;
@@ -56,29 +55,42 @@ public void start(final WorkflowJob project, final boolean newInstance) {
       super.start(project, newInstance);
       // we only care about pull requests
       if (SCMHead.HeadByItem.findHead(project) instanceof PullRequestSCMHead) {
-          DescriptorImpl.jobs
-                  .computeIfAbsent(getKey(project), key -> new HashSet<>())
-                  .add(project);
+          final String key = getKey(project);
+          if (key != null) {
+              DescriptorImpl.jobs
+                      .computeIfAbsent(key, k -> new HashSet<>())
+                      .add(project);
+          }
       }
   }
 
   @Override
   public void stop() {
       if (SCMHead.HeadByItem.findHead(job) instanceof PullRequestSCMHead) {
-          DescriptorImpl.jobs.getOrDefault(getKey(job), Collections.emptySet())
-                  .remove(job);
+          final String key = getKey(job);
+          if (key != null) {
+              DescriptorImpl.jobs.getOrDefault(key, Collections.emptySet())
+                      .remove(job);
+          }
       }
   }
 
-  @SuppressFBWarnings("NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE")
   private String getKey(final WorkflowJob project) {
-      final GitHubSCMSource scmSource = (GitHubSCMSource) SCMSource.SourceByItem.findSource(project);
-      final PullRequestSCMHead scmHead = (PullRequestSCMHead) SCMHead.HeadByItem.findHead(project);
+      final SCMSource scmSource = SCMSource.SourceByItem.findSource(project);
+      if (!(scmSource instanceof GitHubSCMSource)) {
+          LOG.warn("Job: {} has a non-GitHub SCM source: {}, skipping trigger registration",
+                  project.getFullName(), scmSource != null ? scmSource.getClass().getName() : "null");
+          return null;
+      }
+      final SCMHead scmHead = SCMHead.HeadByItem.findHead(project);
+      if (!(scmHead instanceof PullRequestSCMHead)) {
+          return null;
+      }
 
       return String.format("%s/%s/%d",
-              scmSource.getRepoOwner(),
-              scmSource.getRepository(),
-              scmHead.getNumber()).toLowerCase();
+              ((GitHubSCMSource) scmSource).getRepoOwner(),
+              ((GitHubSCMSource) scmSource).getRepository(),
+              ((PullRequestSCMHead) scmHead).getNumber()).toLowerCase();
   }
 
   boolean matches(final String reviewState) {
