From 234f0b55e039e2132f6b3d048641efcbe8d5ba88 Mon Sep 17 00:00:00 2001
From: Guruprasad Bhat <gbhat@cloudbees.com>
Date: Mon, 29 Jun 2026 17:49:35 +0530
Subject: [PATCH] invalidate connection and retry on 401

---
 .../plugins/github_branch_source/Connector.java  |  9 +++++++++
 .../github_branch_source/GitHubSCMSource.java    | 16 +++++++++++++++-
 2 files changed, 24 insertions(+), 1 deletion(-)

diff --git a/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java b/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
index 8a8a52eae..d297e9c5e 100644
--- a/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
+++ b/src/main/java/org/jenkinsci/plugins/github_branch_source/Connector.java
@@ -515,6 +515,15 @@ public static void release(@CheckForNull GitHub hub) {
         }
     }
 
+    static void invalidate(@NonNull GitHub hub) {
+        ConnectionId connectionId = reverseLookup.get(hub);
+        if (connectionId == null) {
+            return;
+        }
+        connections.remove(connectionId);
+        reverseLookup.remove(hub);
+    }
+
     static List<DomainRequirement> githubDomainRequirements(String apiUri) {
         return URIRequirementBuilder.fromUri(StringUtils.defaultIfEmpty(apiUri, GitHubServerConfig.GITHUB_URL))
                 .build();
diff --git a/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMSource.java b/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMSource.java
index 01fc3b904..a6ad29b38 100644
--- a/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMSource.java
+++ b/src/main/java/org/jenkinsci/plugins/github_branch_source/GitHubSCMSource.java
@@ -1421,7 +1421,21 @@ protected SCMRevision retrieve(@NonNull String headName, @NonNull TaskListener l
             }
 
             String fullName = repoOwner + "/" + repository;
-            ghRepository = github.getRepository(fullName);
+            try {
+                ghRepository = github.getRepository(fullName);
+            } catch (HttpException e) {
+                if (e.getResponseCode() != HttpServletResponse.SC_UNAUTHORIZED) {
+                    throw e;
+                }
+                LOGGER.fine(() -> "token seems to be rotated, retrying with fresh credentials");
+                Connector.invalidate(github);
+                GitHub retryGitHub = Connector.connect(apiUri, getCredentials(retrieveContext, true));
+                try {
+                    ghRepository = retryGitHub.getRepository(fullName);
+                } finally {
+                    Connector.release(retryGitHub);
+                }
+            }
             final GHRepository ghRepository = this.ghRepository;
             listener.getLogger()
                     .format(