Issue
CloudBees CI builds are throwing errors similar to the following:
org.jenkinsci.plugins.scriptsecurity.scripts.UnapprovedUsageException: script not yet approved for use at org.jenkinsci.plugins.scriptsecurity.scripts.ScriptApproval.using(ScriptApproval.java:668) at jdk.internal.reflect.GeneratedMethodAccessor1904.invoke(Unknown Source) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:566) at org.codehaus.groovy.reflection.CachedMethod.invoke(CachedMethod.java:98) at groovy.lang.MetaMethod.doMethodInvoke(MetaMethod.java:325) at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1225) at groovy.lang.MetaClassImpl.invokeMethod(MetaClassImpl.java:1034) at org.codehaus.groovy.runtime.callsite.PojoMetaClassSite.call(PojoMetaClassSite.java:46) at org.codehaus.groovy.runtime.callsite.AbstractCallSite.call(AbstractCallSite.java:136) at com.splunk.splunkjenkins.UserActionDSL.perform(UserActionDSL.groovy:39) at com.splunk.splunkjenkins.listeners.LoggingRunListener.onCompleted(LoggingRunListener.java:85) at hudson.model.listeners.RunListener.lambda$fireCompleted$0(RunListener.java:223) at jenkins.util.Listeners.lambda$notify$0(Listeners.java:59) at jenkins.util.Listeners.notify(Listeners.java:67) at hudson.model.listeners.RunListener.fireCompleted(RunListener.java:221) at hudson.model.Run.execute(Run.java:1890) at hudson.model.FreeStyleBuild.run(FreeStyleBuild.java:44) at hudson.model.ResourceController.execute(ResourceController.java:101) at hudson.model.Executor.run(Executor.java:443) Finished: SUCCESS
However, when inspecting Manage Jenkins > In-process Script Approval, no scripts appear for manual approval.
Observation
Other than the error mentioned in the build logs, the controller logs show a SEVERE message referencing a UserActionDSL
script failing:
2024-12-04 23:30:53.105+0000 [id=2184103] SEVERE o.c.g.reflection.CachedMethod#invoke: UserActionDSL script failed org.jenkinsci.plugins.scriptsecurity.item_occupational_agenda.UnapprovedUsageException: script not yet approved for use at org.jenkinsci.plugins.scriptsecurity.item_occupational_agenda.ScriptApproval.using(ScriptApproval.java:668) at jdk.internal.reflect.GeneratedMethodAccessor1904.invoke(Unknown Source) ... at com.splunk.splunkjenkins.UserActionDSL.perform(UserActionDSL.groovy:39)
Root Cause
This error is triggered by the Splunk plugin, which internally executes Groovy scripts (for example, UserActionDSL
) as part of its event listeners. If an administrator edits and saves the script in the Splunk plugin configuration, then SplunkJenkinsInstallation.checkApprove calls ScriptApproval.configuring (javadoc), which should automatically approve the script. Starting with recent change, these scripts are no longer auto‑approved and must be explicitly approved by an CloudBees CI administrator to resolve the build errors.
This behaviour is publicly tracked in JENKINS‑54226.
Resolution
These scripts must be manually approved by a CloudBees CI administrator following the steps below:
-
Navigate to Manage Jenkins > System > Splunk for Jenkins Configuration.
-
Click Advanced to expand the advanced settings to see the pending scripts awaiting approval under Customize Event Processing Command.
-
Without changing any values, click Save at the bottom of the page. This forces the plugin to register its Groovy scripts with CloudBees CI.
-
Navigate to Manage Jenkins > In‑process Script Approval and approve the newly listed Splunk scripts.
-
Re-run the affected jobs which should now complete without the exception.
This approval is one time per plugin version. After the scripts are approved, subsequent builds will run normally unless a future plugin update introduces new scripts. |
Tested product/plugin versions
-
CloudBees CI on traditional platforms - client controller 2.452.4.1
-
Splunk Plugin 1.10.1