[JENKINS-59109] Bind triggering user's credentials

[sbgertp]

Fixes JENKINS-59109

[jvz]

Not exactly what I had in mind originally, but this might work. I'll take a closer look at this later in the week. In the meantime, maybe @jglick has any feedback?

[jglick]

I do not understand at a conceptual level how user-scoped credentials are supposed to work, so I cannot comment on whether this is “right”. IIUC the effective change here is that UserIdCause is being considered not just on the “current” build but also on its transitive upstreams?

[jvz]

Yeah I think this might be backwards. I'd expect a build with a build step to bind its credential parameter bindings to the invoked build.

[sbgertp]

Yeah I think this might be backwards. I'd expect a build with a build step to bind its credential parameter bindings to the invoked build.

I agree that the binding should happen at the call site of the upstream build creating the downstream one. But changing the architecture for me is a bit much, so I framed this as a bug of the current implementation - it already performs deferred binding of credentials if directly started by the user, it was just missing the case when started by the user as part of a causal chain.

[jvz]

Oh that's interesting! Let me verify this works equivalently to what I had in mind before I can merge this. Should be within the next few days.