Jenkins定时触发任务时Copy Artifact找不到项目报错求助

项目结构 #

• MultiBranchA
  • master_branch
  • feature_branch1
  • feature_branch2 等分支
• FolderB
  • MultiBranchB：仅包含master_branch分支
  • MultiBranchC：仅包含master_branch分支

正常触发逻辑 #

MultiBranchA的分支会触发FolderB内的多分支流水线构建，核心代码如下：

stage("tests") {
    when {
        { return params.FunctionalTests }
    }
    steps {
       catchError(buildResult:"SUCCESS", stageResult: "FAILURE"){
           script {
               if (params.FunctionalTests && params.OtherParam)
               build wait: true, propagate: true, job: 'FolderB/MultiBranchA/master_branch', 
               parameters: [string(name: 'passTreshold', value: '100'), 
                            string(name: 'unstableTreshold', value: '90'), 
                            // 其他参数省略
                            ]
             }
         }
    }
}

被触发的任务（ProjectB）会从上游复制构件，代码：

stage ("Copy artifacts") {
    steps {
        script {
            echo "Try to copy artifacts"    
            copyArtifacts (projectName:"MultiBranchA/master_branch", filter: "image_file.swu", 
                           selector: lastSuccessful(), fingerprintArtifacts: true)
        }
   }
}

问题触发点 #

为MultiBranchA添加定时触发器后，定时触发的构建在触发ProjectB时出现copyArtifact报错：

triggers {
  cron( env.BRANCH_NAME.equals('master_branch') ? '0 2 * * *' : '')
}

报错信息 #

Also:   org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: ff3884e9-3af0-4d44-b474-76708d907d64
hudson.AbortException: Unable to find project for artifact copy: ProjectA/master_branch
This may be due to incorrect project name or permission settings; see help for project name in job configuration.
    at hudson.plugins.copyartifact.CopyArtifact.perform(CopyArtifact.java:480)
    at jenkins.tasks.SimpleBuildStep.perform(SimpleBuildStep.java:123)
    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:101)
    at org.jenkinsci.plugins.workflow.steps.CoreStep$Execution.run(CoreStep.java:71)
    at org.jenkinsci.plugins.workflow.steps.SynchronousNonBlockingStepExecution.lambda$start$0(SynchronousNonBlockingStepExecution.java:47)
    at java.base/java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:515)
    at java.base/java.util.concurrent.FutureTask.run(FutureTask.java:264)
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
    at java.base/java.lang.Thread.run(Thread.java:829)

问题特征：仅定时触发的任务出现该错误，经查此时copyArtifact插件使用匿名用户权限运行，当前使用Role-based Authorization Strategy插件，不愿给匿名用户添加读权限。

已尝试无效方案 #

1. 在ProjectB的Jenkinsfile中添加各种copyArtifactPermission配置：

options {
    disableConcurrentBuilds()
    timestamps()
    buildDiscarder(logRotator(numToKeepStr:"10"))
    // copyArtifactPermission('MultiBranchA')
    // copyArtifactPermission('MultiBranchA/*')
    // copyArtifactPermission('MultiBranchA/master_branch')
    // copyArtifactPermission('*')
}

2. 安装Authorize Project插件，但与多分支流水线兼容差，未显示授权侧边栏；在全局安全配置中开启「Pre-project configurable build Authorization」并尝试所有运行身份选项，均无效。

可行解决思路 #

思路1：触发构建时传递上游身份令牌 #

在MultiBranchA触发ProjectB时，带上当前构建的身份凭证，让ProjectB以上游构建的用户身份执行copyArtifact操作：

// 修改MultiBranchA中触发ProjectB的代码
build wait: true, propagate: true, job: 'FolderB/MultiBranchA/master_branch', 
parameters: [
    string(name: 'passTreshold', value: '100'), 
    string(name: 'unstableTreshold', value: '90'),
    // 传递上游构建标识参数
    string(name: 'UPSTREAM_BUILD_ID', value: env.BUILD_ID),
    string(name: 'UPSTREAM_JOB_NAME', value: env.JOB_NAME)
],
// 传递上游构建的身份令牌
token: env.BUILD_TOKEN

在ProjectB的copyArtifacts步骤中，使用上游构建选择器并指定触发者权限：

stage ("Copy artifacts") {
    steps {
        script {
            echo "Try to copy artifacts from upstream build"    
            copyArtifacts (
                projectName: params.UPSTREAM_JOB_NAME, 
                filter: "image_file.swu", 
                selector: specific(params.UPSTREAM_BUILD_ID), 
                fingerprintArtifacts: true,
                // 使用触发该构建的用户权限
                authentication: trigger()
            )
        }
   }
}

思路2：以系统用户身份运行copyArtifact步骤 #

利用Jenkins系统用户的全量权限，在copyArtifacts步骤中指定系统用户身份执行。需预先创建拥有足够权限的系统用户并生成API令牌：

stage ("Copy artifacts") {
    steps {
        script {
            echo "Try to copy artifacts as system user"
            withCredentials([string(credentialsId: 'system-user-api-token', variable: 'SYSTEM_TOKEN')]) {
                copyArtifacts (
                    projectName:"MultiBranchA/master_branch", 
                    filter: "image_file.swu", 
                    selector: lastSuccessful(), 
                    fingerprintArtifacts: true,
                    authentication: usernamePassword(
                        username: 'system-user',
                        password: SYSTEM_TOKEN
                    )
                )
            }
        }
   }
}

思路3：指定定时触发器的运行身份 #

1. 在Role-based Authorization Strategy中创建服务用户（如jenkins-service），赋予其MultiBranchA和FolderB的读权限；
2. 修改定时触发配置，让任务以该服务用户身份运行：

triggers {
    cron('0 2 * * *') {
        user('jenkins-service')
    }
}

注：若Pipeline不支持直接指定用户，可在Jenkins全局配置中添加定时任务，触发MultiBranchA的master分支并指定运行用户。

思路4：调整Folder级权限规则 #

在Role-based Authorization Strategy中，为FolderB添加权限规则，允许触发构建的用户（即定时任务使用的服务用户）读取MultiBranchA的构件，确保ProjectB能继承该权限完成复制操作。

内容的提问来源于stack exchange，提问作者KamRos