Environment

• OneDev Version: 16.9.4 (upgraded from 16.8.6)
• Repository Source: Migrated from Bitbucket
• Project: leosys/xsq/leo-xsq
• Parent Project: leosys
• Shared Build Spec Project: leosys/core/leo-ci-mvn
• Build Spec Revision: v1

Problem Description

After migrating our Git repository from Bitbucket to OneDev, we encountered two issues.

Both issues were observed on OneDev 16.8.6 and still occur after upgrading to 16.9.4.

1. NullPointerException when retrieving Git commit history

OneDev throws a NullPointerException while serializing Git commit information in a REST API response.

Error log:

15:11:35 ERROR o.g.j.server.ServerRuntime$Responder
An I/O error has occurred while writing a response message entity.

com.fasterxml.jackson.databind.JsonMappingException:
(was java.lang.NullPointerException)
(through reference chain:
java.util.ArrayList[0]
->io.onedev.server.git.command.LogCommit["committer"])

Caused by: java.lang.NullPointerException

The exception occurs when accessing the committer property of LogCommit during JSON serialization.

Since the repository was migrated from Bitbucket, we suspect that certain historical Git commit metadata may be triggering this issue. However, we have not confirmed whether the root cause is invalid commit metadata or a OneDev parsing/serialization bug.

Expected behavior:

OneDev should correctly handle Git commit metadata and return commit history without throwing an unhandled exception.

2. Job secret validation warning despite correct parent-level configuration

OneDev periodically logs the following warning when checking automatic job triggers:

15:14:21 WARN i.o.server.job.DefaultJobService
Error checking job triggers

Project: leosys/xsq/leo-xsq
Commit: f931f2c634d3b19e760ed71be47a7fb10828f57a

jakarta.validation.ValidationException:
Error validating build spec

Location: imports[0]

Unable to import build spec
Import project: leosys/core/leo-ci-mvn
Import revision: v1

No authorized job secret found
Project: leosys/xsq/leo-xsq
Job secret: job-code-writer

Existing configuration:

The job-code-writer secret is already configured in the parent project leosys.

Its authorization rule is:

on branch "**"

The child project leosys/xsq/leo-xsq has also completed builds successfully.

However, automatic job-trigger validation still reports that no authorized secret can be found.

Expected behavior:

Child projects should correctly inherit authorized job secrets from their parent project, including during automatic build-trigger validation.

Questions

1. Is the LogCommit["committer"] NullPointerException a known issue in OneDev 16.9.4, particularly for repositories migrated from Bitbucket?
2. Is there a way to identify and fix the problematic Git commit metadata without rewriting Git history?
3. Why does automatic job-trigger validation fail to resolve the inherited job-code-writer secret when builds can complete successfully?
4. Could the job secret warning be related to commits not reachable from regular branches, such as temporary PR merge commits?
5. Are these two issues potentially related, or should they be investigated independently?

Additional Notes

• Upgrading from OneDev 16.8.6 to 16.9.4 did not resolve the reported problems.
• We would prefer to preserve the existing Git history, commit SHAs, and shared CI configuration.
• We can provide additional diagnostic logs or Git commit metadata if needed.

Thank you for your assistance.