Class PendingApprovalAction.ApprovalQueueGuard

java.lang.Object
hudson.model.Queue.QueueDecisionHandler
io.jenkins.plugins.github_pr_approval.PendingApprovalAction.ApprovalQueueGuard
All Implemented Interfaces:
ExtensionPoint
Enclosing class:
PendingApprovalAction
@Extension public static class PendingApprovalAction.ApprovalQueueGuard extends Queue.QueueDecisionHandler
The gate that actually stops an unapproved fork pull request from building.

Disabling the job (see PendingApprovalAction.ApprovalItemListener) is not enough on its own. When branch indexing discovers a new fork PR it schedules that PR's first build in the same pass, and that build can win the race against the job being disabled — which is how an unapproved PR slipped through and built. A manual "Build Now" or a re-trigger would get past a disabled job too. Jenkins asks every Queue.QueueDecisionHandler before it queues anything, so refusing here blocks the build no matter what triggered it. The disabled flag is then just what the user sees; this is what enforces it.

This runs while the build queue is locked, so it stays deliberately cheap: a few in-memory checks and one small file read — never a GitHub call and never a write.