Multibranch Discovery and Checkout

Scenario: Manual branch jobs remain after branches disappear and a deployment runs from an ambiguous branch name.

Pipeline example

pipeline { agent any; options { skipDefaultCheckout(true) }; stages { stage('SCM') { steps { checkout scm } } } }

Indexing manages branch jobs

A Multibranch Pipeline scans an SCM source, discovers heads, and creates a child job for each qualifying branch or pull request that contains a Jenkinsfile. Branch indexing discovers configuration; it is not itself a build. Webhooks provide low-latency change events, while periodic scans reconcile missed events and deleted branches. Orphan strategy controls how long removed branch jobs retain evidence instead of leaving them forever or deleting them immediately.

SCM traits configure branch, tag, pull-request, and fork discovery. Pull requests may build the head revision or a synthetic merge with the target. Head testing asks whether the contribution passes alone; merge testing asks whether it integrates with the current target and becomes stale whenever that target moves. Duplicate discovery strategies can build the same revision twice.

Use the discovered SCM identity

Checkout scm uses the exact provider-specific revision selected during indexing. Rebuilding a checkout URL from BRANCH_NAME is unsafe because a pull-request display name may not be a literal remote branch. Record commit SHA, change ID, target, trust strategy, and checkout mode. Filters and Jenkinsfile path are part of discovery policy and should be reviewed.

Never expose release credentials to an untrusted fork Jenkinsfile. Use a trusted definition or isolated unprivileged PR job, then reserve publication for reviewed revisions. When a branch is missing, read the indexing log for API permissions, rate limits, traits, filters, and Jenkinsfile presence before creating a manual job that bypasses the designed lifecycle.

Goal: Practice the concrete behavior in jenkins-scm-trigger-recovery. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.