Jenkins Pipeline Submodule Authentication

Question

I have a repository that contains submodules. These are developed in a publicly accessible GitHub repository. My final deployment however is in a disconnected environment with mirrored GitHub repos in GitLab, which all require authentication.

My .gitmodules file contains URLs for the publicly available repos. I did some sed replacement in the job and can update them properly, but unfortunately, I'm then not able to authenticate, since it's a separate operation from the git url:.... step.

I can clone the project with:

git url: "git@my.gitlab.secure", branch: "master", credentialsId: "somecredentialid"

This doesn't update my submodules though unfortunately. And since I require authentication.

I also can clone using the checkout:

      checkout([                                                            
        $class: 'GitSCM',                                                   
        branches: [[name: 'master']],                               
        doGenerateSubmoduleConfigurations: true,                            
        extensions: [[$class: 'SubmoduleOption',                            
          disableSubmodules: false,                                         
          parentCredentials: true,                                          
          recursiveSubmodules: true,                                        
          reference: '', trackingSubmodules: true]],                        
          submoduleCfg: [],                                                 
          userRemoteConfigs: [[credentialsId: 'somecredentialid',         
          url: 'git@my.gitlab.secure']]                                            
      ])                                                                    
    }                                                                       
  }

It isn't clear to me from the documentation what doGenerateSubmoduleConfigurations: true, and submoduleCfg: are for.

I feel like the checkout way might be the solution, but I can't figure out how to update the .gitmodules to reflect the secured URLs for the submodules.

`git@my.gitlab.secure`, this is actually using `ssh://`, maybe you can change to use `https://`, what does your submodule url look like? — chenrui, Jul 08 '17 at 23:09
It can look like anything I want, right now the `.gitmodules` contains entries like this: url = https://github.com/someorg/somerepo.git Regardless, those have to be changed to point to the self-hosted secure repositories. — user193673, Jul 10 '17 at 12:32
Here is how to provide credentials to submodule checkout: https://stackoverflow.com/a/62789511/901508 — Nikita, Feb 12 '23 at 09:47

score 2 · Answer 1 · answered Jan 16 '20 at 21:55

This works for me in my case which is similar to what you trying to do here; see if this helps.

checkout changelog: true, poll: true, scm: [
        $class: 'GitSCM',
        branches: [[name: "master"]],
        doGenerateSubmoduleConfigurations: false,
        extensions: [[$class: 'SubmoduleOption', recursiveSubmodules: true, parentCredentials: true], [$class: 'PruneStaleBranch']],
        submoduleCfg: [],
        userRemoteConfigs: [[name: 'origin', url: "Git ssh URL/${projectName}.git", credentialsId: 'Git credential']]
]

score 2 · Answer 2 · answered May 25 '20 at 05:23

Having bashed my head against this a while too, here's what I found.

doGenerateSubmoduleConfigurations is exposed as scm.doGenerateSubmoduleConfigurations which suggests that it invokes SubmoduleCombinator. That doesn't look like what you want at all. The option should probably be (a) in an extension not the core plugin and (b) be called doGenerateSubmoduleCombinationMatrix or something.

submoduleCfg doesn't seem to get much obvious use in the git plugin. All I found for it was tests where it's empty.

Functionality seems to have moved into SubmoduleOption. This has method onCheckoutCompleted(...) that calls git.submoduleUpdate(...).

So AFAICS the extensions entry for class SubmoduleOption is what you want. And the docs are a bit special.

Jenkins Pipeline Submodule Authentication

2 Answers2