[JENKINS-76287] ClassCastException when using repository access strategy

[jenkins-infra-bot]

The following error occurs when we set a repository access strategy on a github app credential:

hudson.remoting.ProxyException: java.lang.ClassCastException: class java.lang.String cannot be cast to class java.lang.Enum (java.lang.String and java.lang.Enum are in module java.base of loader 'bootstrap')
		at PluginClassLoader for github-api//org.kohsuke.github.GHAppCreateTokenBuilder.permissions(GHAppCreateTokenBuilder.java:94)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:331)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:768)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:753)
		at hudson.remoting.UserRequest.perform(UserRequest.java:225)
		at hudson.remoting.UserRequest.perform(UserRequest.java:50)
		at hudson.remoting.Request$2.run(Request.java:391)
		at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:81)
		at org.jenkinsci.remoting.CallableDecorator.call(CallableDecorator.java:18)
		at hudson.remoting.CallableDecoratorList.lambda$applyDecorator$0(CallableDecoratorList.java:21)
		at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
		at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:80)
		at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

It seems this is a bug in

github-branch-source-plugin/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java

Line 775 in 9ee8a39

(Map<String, GHPermissionType>) fields.get("permissions"),

where an improper cast is done from JSONObject to Map. At best it's probably safe to say Map, but the map value has to be deserialized back to the GHPermissionType enum.

---

Originally reported by thatsmydoing, imported from: ClassCastException when using repository access strategy

• status: Open
• priority: Minor
• component(s): github-branch-source-plugin
• resolution: Unresolved
• votes: 0
• watchers: 1
• imported: 2025-12-02

Raw content of original issue

The following error occurs when we set a repository access strategy on a github app credential:

hudson.remoting.ProxyException: java.lang.ClassCastException: class java.lang.String cannot be cast to class java.lang.Enum (java.lang.String and java.lang.Enum are in module java.base of loader 'bootstrap')
		at PluginClassLoader for github-api//org.kohsuke.github.GHAppCreateTokenBuilder.permissions(GHAppCreateTokenBuilder.java:94)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials.generateAppInstallationToken(GitHubAppCredentials.java:331)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:768)
		at PluginClassLoader for github-branch-source//org.jenkinsci.plugins.github_branch_source.GitHubAppCredentials$DelegatingGitHubAppCredentials$GetToken.call(GitHubAppCredentials.java:753)
		at hudson.remoting.UserRequest.perform(UserRequest.java:225)
		at hudson.remoting.UserRequest.perform(UserRequest.java:50)
		at hudson.remoting.Request$2.run(Request.java:391)
		at hudson.remoting.InterceptingExecutorService.lambda$wrap$0(InterceptingExecutorService.java:81)
		at org.jenkinsci.remoting.CallableDecorator.call(CallableDecorator.java:18)
		at hudson.remoting.CallableDecoratorList.lambda$applyDecorator$0(CallableDecoratorList.java:21)
		at jenkins.util.ContextResettingExecutorService$2.call(ContextResettingExecutorService.java:46)
		at jenkins.security.ImpersonatingExecutorService$2.call(ImpersonatingExecutorService.java:80)
		at java.base/java.util.concurrent.FutureTask.run(Unknown Source)
		at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
		at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)

It seems this is a bug in 

  

    

      github-branch-source-plugin/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubAppCredentials.java
    
    

         Line 775
      in
      9ee8a39
    
  
  

    


        

          

          
 (Map<String, GHPermissionType>) fields.get("permissions"), 
        
    
  

 where an improper cast is done from JSONObject to Map<String, GHPermissionType>. At best it's probably safe to say Map<String, String>, but the map value has to be deserialized back to the GHPermissionType enum.

environment

Jenkins: 2.528.1<br/>
OS: Linux - 6.1.153-175.280.amzn2023.x86_64<br/>
Java: 21.0.8 - Eclipse Adoptium (OpenJDK 64-Bit Server VM)<br/>
github-branch-source:1917.v9ee8a_39b_3d0d