Jenkins Pipeline Submodule Authentication

Question

I have a repository that contains submodules. These are developed in a publicly accessible GitHub repository. My final deployment however is in a disconnected environment with mirrored GitHub repos in GitLab, which all require authentication.

My .gitmodules file contains URLs for the publicly available repos. I did some sed replacement in the job and can update them properly, but unfortunately, I'm then not able to authenticate, since it's a separate operation from the git url:.... step.

I can clone the project with:

git url: "[email protected]", branch: "master", credentialsId: "somecredentialid"

This doesn't update my submodules though unfortunately. And since I require authentication.

I also can clone using the checkout:

      checkout([                                                            
        $class: 'GitSCM',                                                   
        branches: [[name: 'master']],                               
        doGenerateSubmoduleConfigurations: true,                            
        extensions: [[$class: 'SubmoduleOption',                            
          disableSubmodules: false,                                         
          parentCredentials: true,                                          
          recursiveSubmodules: true,                                        
          reference: '', trackingSubmodules: true]],                        
          submoduleCfg: [],                                                 
          userRemoteConfigs: [[credentialsId: 'somecredentialid',         
          url: '[email protected]']]                                            
      ])                                                                    
    }                                                                       
  }

It isn't clear to me from the documentation what doGenerateSubmoduleConfigurations: true, and submoduleCfg: are for.

I feel like the checkout way might be the solution, but I can't figure out how to update the .gitmodules to reflect the secured URLs for the submodules.

Answer 1

This works for me in my case which is similar to what you trying to do here; see if this helps.

checkout changelog: true, poll: true, scm: [
        $class: 'GitSCM',
        branches: [[name: "master"]],
        doGenerateSubmoduleConfigurations: false,
        extensions: [[$class: 'SubmoduleOption', recursiveSubmodules: true, parentCredentials: true], [$class: 'PruneStaleBranch']],
        submoduleCfg: [],
        userRemoteConfigs: [[name: 'origin', url: "Git ssh URL/${projectName}.git", credentialsId: 'Git credential']]
]

Answer 2

Having bashed my head against this a while too, here's what I found.

doGenerateSubmoduleConfigurations is exposed as scm.doGenerateSubmoduleConfigurations which suggests that it invokes SubmoduleCombinator. That doesn't look like what you want at all. The option should probably be (a) in an extension not the core plugin and (b) be called doGenerateSubmoduleCombinationMatrix or something.

submoduleCfg doesn't seem to get much obvious use in the git plugin. All I found for it was tests where it's empty.

Functionality seems to have moved into SubmoduleOption. This has method onCheckoutCompleted(...) that calls git.submoduleUpdate(...).

So AFAICS the extensions entry for class SubmoduleOption is what you want. And the docs are a bit special.