[shenxianpeng]

Description

Three permission and safety fixes:

1. Asking for a new explanation needs Job/Build. The console page and the Stages page called the AI provider for any user with Job/Read, anonymous readers included, and forceNew=true let them replace the explanation a build has. A new explanation now needs Job/Build; Job/Read still shows the explanation a build already has, and the button is only offered to users who may use it. A request while an explanation of the build is being generated is answered with a warning instead of a second provider call, and the maxLines request parameter is capped at 1000 lines.
2. "Test Configuration" looks credentials up where the form is. It resolved credentialsId (Anthropic, Qwen, Azure OpenAI) with no item, which falls back to the Jenkins root as SYSTEM, so a folder or job form could send a credential that only Jenkins itself may use to the URL typed in the form. It now looks the credential up in the folder or job the form belongs to, as a build of that item does.
3. Auto-fix leaves CI and pipeline definitions alone unless they are named. A change to Jenkinsfile, .github/workflows/*, .gitlab-ci.yml, bitbucket-pipelines.yml and the like decides what a build of the pushed fix branch runs. Such a file is changed only when autoFixAllowedPaths spells out its path (a pattern that does not start with a wildcard). Jenkinsfile leaves the default list, an empty list allows nothing, globs match the normalized path, and backslashes are refused.

README and docs/auto-fix.md describe the new rules.

Before / After

Same steps against a local Jenkins 2.528.3 with an OpenAI-compatible mock provider, anonymous read access, main (b048ffd) vs this branch:

#	Check	Before	After
1	Anonymous asks for a new explanation	HTTP 200, provider called once	HTTP 403, provider not called
2	Anonymous sends forceNew=true for a build that has an explanation	HTTP 200, provider called, explanation replaced	HTTP 403, provider not called, explanation kept
3	Anonymous opens the explanation a build has	HTTP 200	HTTP 200 (unchanged)
4	A second request while the first is still running	answered from a second provider call (2 calls)	warning "already being generated" (1 call)
5	maxLines=100000000 on a 200,000-line log	200,000 lines sent to the provider	999 lines sent
6	Folder "Test Configuration" names a SYSTEM-scoped credential	1 request to the form URL, carrying the secret	no request; "credentials not found"
7	Console page of a failed build without an explanation, anonymous	"Explain Error" button	no button

Auto-fix path check, through attemptAutoFix with the step's default allow-list unless noted:

Suggested file	Allow-list	Before	After
.github/workflows/release.yml	default	accepted	refused before any branch is created
Jenkinsfile	default	accepted	refused
.gitlab-ci.yml	default	accepted	refused
pom.xml	default	accepted	accepted (unchanged)
pom.xml	'' (empty)	accepted	refused
src/../Jenkinsfile	src/**	accepted	refused
Jenkinsfile	pom.xml,Jenkinsfile	accepted	accepted

Console page of a failed build without an explanation, seen by an anonymous reader:

	Before	After
Desktop
Mobile

After: a reader still opens the explanation a build has, without the control to replace it:

Related Issues

None.

Testing done

• New ExplanationPermissionTest: Job/Read vs Job/Build on both endpoints, forceNew, pending requests, the maxLines cap and the button on the console page.
• ProviderTestConfigurationTest: a folder form cannot send a SYSTEM-scoped credential (Anthropic, Qwen, Azure OpenAI) and still sends one the folder can use.
• AutoFixOrchestratorTest: CI and pipeline definitions, wildcard patterns, empty lists, normalized paths, backslashes.
• mvn verify (JDK 21): 901 tests pass, SpotBugs reports no issues.
• Manual check of the table above on a local Jenkins.

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Link to relevant issues in GitHub or Jira
• Link to relevant pull requests, esp. upstream and downstream changes
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

---

Was generative AI tooling used to co-author this PR?

• Yes (please specify below)