CloudBees CI Builds throwing error with "script not yet approved for use" but there is nothing to approve in Script Approval

Last Reviewed:2025-06-16()
2 minute readKnowledge base

Issue

CloudBees CI builds are throwing errors similar to the following:

org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedUsageException: script not yet approved for use
	at org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.using(ScriptApproval.java:668)
	at jdk.internal.reflect.GeneratedMethodAccessor1904.invoke(Unknown Source)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:566)
	at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98)
	at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1225)
	at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034)
	at org.codehaus.groovy.runtime.callsite.PojoMetaClassSite.call(PojoMetaClassSite.java:46)
	at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:136)
	at com.splunk.splunkjenkins.UserActionDSL.perform(UserActionDSL.groovy:39)
	at com.splunk.splunkjenkins.listeners.LoggingRunListener.onCompleted(LoggingRunListener.java:85)
	at hudson.model.listeners.RunListener.lambda$fireCompleted$0(RunListener.java:223)
	at jenkins.util.Listeners.lambda$notify$0(Listeners.java:59)
	at jenkins.util.Listeners.notify(Listeners.java:67)
	at hudson.model.listeners.RunListener.fireCompleted(RunListener.java:221)
	at hudson.model.Run.execute(Run.java:1890)
	at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44)
	at hudson.model.ResourceController.execute(ResourceController.java:101)
	at hudson.model.Executor.run(Executor.java:443)
Finished: SUCCESS
▼

However, when inspecting Manage Jenkins > In-process Script Approval, no scripts appear for manual approval.

Environment

Observation

Other than the error mentioned in the build logs, the controller logs show a SEVERE message referencing a UserActionDSL script failing:

2024-12-04 23:30:53.105+0000 [id=2184103] SEVERE o.c.g.reflection.CachedMethod#invoke: UserActionDSL script failed
org.jenkinsci.plugins.scriptsecurity.item_occupational_agenda.UnapprovedUsageException: script not yet approved for use
    at org.jenkinsci.plugins.scriptsecurity.item_occupational_agenda.ScriptApproval.using(ScriptApproval.java:668)
    at jdk.internal.reflect.GeneratedMethodAccessor1904.invoke(Unknown Source)
    ...
    at com.splunk.splunkjenkins.UserActionDSL.perform(UserActionDSL.groovy:39)
▼

Root Cause

This error is triggered by the Splunk plugin, which internally executes Groovy scripts (for example, UserActionDSL) as part of its event listeners. If an administrator edits and saves the script in the Splunk plugin configuration, then SplunkJenkinsInstallation.checkApprove calls ScriptApproval.configuring (javadoc), which should automatically approve the script. Starting with recent change, these scripts are no longer auto‑approved and must be explicitly approved by an CloudBees CI administrator to resolve the build errors.

This behaviour is publicly tracked in JENKINS‑54226.

Resolution

These scripts must be manually approved by a CloudBees CI administrator following the steps below:

  1. Navigate to Manage Jenkins > System > Splunk for Jenkins Configuration.

  2. Click Advanced to expand the advanced settings to see the pending scripts awaiting approval under Customize Event Processing Command.

  3. Without changing any values, click Save at the bottom of the page. This forces the plugin to register its Groovy scripts with CloudBees CI.

  4. Navigate to Manage Jenkins > In‑process Script Approval and approve the newly listed Splunk scripts.

  5. Re-run the affected jobs which should now complete without the exception.

This approval is one time per plugin version. After the scripts are approved, subsequent builds will run normally unless a future plugin update introduces new scripts.

Additional Resources

Tested product/plugin versions