'github-autostatus' plugin sometimes doesn't update each status check in the PR

[yakirtzad]

Jenkins and plugins versions report

Environment

Jenkins Configuration as Code based on Kubernetes

What Operating System are you using (both controller, and any agents involved in the problem)?

Jenkins Configuration as Code based on Kubernetes

Reproduction steps

1. Install the github-autostatus plugin (version 3.6.2)
2. Create an integration with GitHub enterprise based on GitHub-App
3. Try to open a PR on one of the repos in order to trigger the Jenkins PR build
4. Check if jenkins reports the status check on each stage

If you didn't manage to reproduce it, try to open more PRs as this issue not always occures.

Expected Results

Jenkins PR build should always report the status check of each stage to GitHub

Actual Results

Jenkins PR build not always reports the status check of each stage to GitHub.
It seems like an arbitrary issue.

Anything else?

I have an arbitrary issue with the 'github-autostatus' (Job and Stage monitoring) plugin. In some cases (I'm not sure why), it doesn't update the status checks in my pull request.

Once I'm trying to open a new PR or even just run the same jenkins build again, it updates the status checks as expected.

Has anyone encountered this issue before? If not, do you have another Jenkins plugin/solution that reports those status checks to GitHub PRs?

I'm using version 3.6.2 (at this point this is the latest version for this plugin). github-autostatus plugin

[LeeU1911]

I'm having the same issue:

Occasionally, 1 or 2 of my last stages don't get status updates after Jenkins pipeline stages completed. I looked at the Github app log, it doesn't receive a post from Jenkins. That means github-autostatus failed to send the notification to Github for some reason.
It always happens for my last stage and occasionally for the second last. The main difference with other stages are these two usually takes a while to run 15 - 60 mins. The odd thing is it always successfully sends the very last notification after all build stages complete

[eshackelford-ias]

We are seeing this same behavior as well. Is there an update on this?

[niyasimonc]

any update on this issue ?

[samrocketman]

Verified bug

I have verified through source review the root cause. If you're using GitHub app authentication, then you'll see the behavior on jobs longer than 60 minutes.

Behavior

• The github autostatus plugin resolves the API token at the beginning of the job run.
• GitHub App API access tokens have a non-configurable TTL of 60 minutes.
• After 60 minutes GitHub automatically revokes the app token and autostatus stops working.

Potential solutions

This could be solved one of two ways:

• Support GitHub app, track, and rotate cred on TTL expire.
• Alternately, resolve the credential every time before making a GitHub API request at the end of the stage. This would be a little less efficient but more generic for wider credential support. I suggest this for robustness.

[rogerluan]

Great work @samrocketman! Do you know if there any solution we can implement on our end, while the plugin itself is not fixed?

[rogerluan]

@samrocketman just one note, this is our Jenkins steps:

It published the status just fine for steps 1, 2 and 3, but not for 4 and 5. But you can see they add up less than 60mins. When exactly does this plugin resolve the API token from GitHub App?
a) When the job starts (i.e. "declarative checkout SCM" step in my screenshot)
b) At the beginning of each stage
c) When the job is scheduled (in this case, if the job is "on hold" in a queue waiting for resources to become available, the API token expiration time would be counting down already, which is the least desirable behavior...)

If the answer is A or B, your RCA doesn't seem valid for my case, as the execution took less than 60mins. But if it's C, then I think we should also change that behavior, if possible. WDYT?