Fix stale cache validation failures for newly created branches or tags

Refresh cache from git when a parameter value is not found in the
existing cache, not just when cache is null. This fixes validation
failures when downstream builds use newly created branches/tags.

Maintains SECURITY-3419 protections and backwards compatibility.

Author: Mutix

src/main/java/net/uaznia/lukanus/hudson/plugins/gitparameter/GitParameterDefinition.java

@@ -178,9 +178,8 @@ public ParameterValue createValue(StaplerRequest2 request, JSONObject jO) {
 
     @Override
     public ParameterValue createValue(CLICommand command, String value) throws IOException, InterruptedException {
-        // Clear the allowedValues cache when invoked through CLI.
-        // Cache does not need to be cleared when invoked through
-        // Stapler because generateParamList is called to fill the cache
+        // Clear the allowedValues cache when invoked through CLI to ensure fresh data.
+        // The isValid() method will refresh the cache if needed.
         allowedValues = null;
         if (isNotEmpty(value)) {
             GitParameterValue gitParameterValue = new GitParameterValue(getName(), value);
@@ -679,28 +678,35 @@ public boolean isValid(ParameterValue value) {
             return true; // SECURITY-3419
         }
         if (value.getValue() instanceof String strValue) {
-            if (allowedValues == null) {
-                if (Jenkins.getInstanceOrNull() == null) {
-                    return false; // Automated tests only, not a running Jenkins instance
-                }
-                Job job = getParentJob(this);
-                if (job == null) {
-                    return false; // Automated tests with a Jenkins instance
-                }
-                JobWrapper jobWrapper = JobWrapperFactory.createJobWrapper(job);
-                List<GitSCM> scms = getGitSCMs(jobWrapper, getUseRepository());
-                if (scms == null || scms.isEmpty()) {
-                    return false;
-                }
-                try {
-                    // Populate the allowedValues set
-                    allowedValues = generateParamList(jobWrapper, scms).keySet();
-                } catch (Exception e) {
-                    LOGGER.log(Level.SEVERE, "Allowed values not generated", e);
-                    return false;
-                }
+            // Fast path: check if value exists in cache
+            if (allowedValues != null && allowedValues.contains(strValue)) {
+                return true;
+            }
+
+            // Slow path: refresh cache from git and check again
+            // This handles two cases:
+            // 1. Cache is null (never populated)
+            // 2. Cache is stale (value not found, might be a newly created tag/branch)
+            if (Jenkins.getInstanceOrNull() == null) {
+                return false; // Automated tests only, not a running Jenkins instance
+            }
+            Job job = getParentJob(this);
+            if (job == null) {
+                return false; // Automated tests with a Jenkins instance
+            }
+            JobWrapper jobWrapper = JobWrapperFactory.createJobWrapper(job);
+            List<GitSCM> scms = getGitSCMs(jobWrapper, getUseRepository());
+            if (scms == null || scms.isEmpty()) {
+                return false;
+            }
+            try {
+                // Refresh the allowedValues cache from git
+                allowedValues = generateParamList(jobWrapper, scms).keySet();
+                return allowedValues.contains(strValue);
+            } catch (Exception e) {
+                LOGGER.log(Level.SEVERE, "Allowed values not generated", e);
+                return false;
             }
-            return allowedValues.contains(strValue);
         }
         return false;
     }