Parallel test job failed with `Scripts not permitted to use method jenkins.model.HistoricalBuild getNumber. Administrators can decide whether to approve or reject this signature.`

[sophia-guo]

All test jobs ( parallel enabled) failed with Scripts not permitted to use method jenkins.model.HistoricalBuild getNumber. Administrators can decide whether to approve or reject this signature.

[Pipeline] End of Pipeline
Also:   org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: f4a6d8c8-0ace-47d7-9767-a08bafd5bec4
org.jenkinsci.plugins.scriptsecurity.sandbox.RejectedAccessException: Scripts not permitted to use method jenkins.model.HistoricalBuild getNumber
	at PluginClassLoader for script-security//org.jenkinsci.plugins.scriptsecurity.sandbox.whitelists.StaticWhitelist.rejectMethod(StaticWhitelist.java:244)
	at PluginClassLoader for script-security//org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.rejectMethod(SandboxInterceptor.java:594)
	at PluginClassLoader for script-security//org.jenkinsci.plugins.scriptsecurity.sandbox.groovy.SandboxInterceptor.onMethodCall(SandboxInterceptor.java:167)
	at PluginClassLoader for script-security//org.kohsuke.groovy.sandbox.impl.Checker$1.call(Checker.java:178)
	at PluginClassLoader for script-security//org.kohsuke.groovy.sandbox.impl.Checker.checkedCall(Checker.java:182)
	at PluginClassLoader for workflow-cps//com.cloudbees.groovy.cps.sandbox.SandboxInvoker.methodCall(SandboxInvoker.java:17)
	at PluginClassLoader for workflow-cps//org.jenkinsci.plugins.workflow.cps.LoggingInvoker.methodCall(LoggingInvoker.java:118)
	at Script1.archiveChildJobTap(Script1.groovy:1554)
	at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.callClosureForMapEntry(CpsDefaultGroovyMethods:5363)
	at com.cloudbees.groovy.cps.CpsDefaultGroovyMethods.each(CpsDefaultGroovyMethods:2202)
	at Script1.archiveChildJobTap(Script1.groovy:1551)

Example:
https://ci.adoptium.net/job/Test_openjdk17_hs_extended.openjdk_aarch64_linux/230/

[sophia-guo]

Seems jenkins script permission changed ? Currently it complains def buildId = jobInvocation.getNumber(). If permission is changed, suspect there might be some other methods, which also have the same issue. @sxa @Haroon-Khel if recent jenkins update caused this?

[sophia-guo]

No issue on May 8th. Happened around May 16th. Related with https://adoptium.slack.com/archives/C5219G28G/p1746625099280909? @sxa

[smlambert]

I have approved it, but interesting that was potentially introduced from the update.

[sophia-guo]

I believe there are likely several other method calls with the same issue — they also require permission. Will rerun a parallel grinder to verify.

[sophia-guo]

https://ci.adoptium.net/view/Test_grinder/job/Grinder/13110/ - OK, no this issue
https://ci.adoptium.net/view/Test_grinder/job/Grinder/13111/ - OK, no issue.

Close it.