Jenkins Groovy Sandbox In-ProcessApproval - jenkins

In Jenkins I am facing an issue as when in pipeline job if Use Groovy Sandbox is unchecked then job should not run
it should come for approval to jenkins administrator.
but currently it is happening reverse way.
If Use Groovy Sandbox is checked : It is asking for approval of jenkins administrator
If Use Groovy Sandbox is uncheck : Pipeline job is getting executing.
can you please help the same how i can achieve the same.
is there any configuration i need to adopt it.
BR,
GauravS

If you use "Groovy sandbox", then you don't have to approve all the script, but you might need to approve some signatures that Jenkins marks as dangerous.
If you run a groovy script without the sandbox, you will need to approve it once. After you've approved, the script will be executed without approval. At least, until you modify the script, so to Jenkins it will look like a new script.

Related

Approve github PR in jenkins pipeline

I am trying to create a process that blocks a github PR from being approved and merged to the main branch until a Jenkins pipeline can confirm that a terraform plan (or whatever checks need to happen for that repo) are successful.
There are two restrictions with though
we're not allowed to install plugins that aren't approved by the company, and that's just too much hassle!
the Jenkins instance is internal so I can't use a webhook
I'm trying to use a multibranch pipeline to execute when a PR is raised but I can't see how to approve the PR once the check is complete, perhaps this isn't the best way to go?
I'd appreciate any help/pointers on this
Thanks

How to run code review working flow for scripting in Jenkins Jobs?

We are running gerrit review working flow on our product development,
But we have no idea to running the same working flow with script of Jenkins jobs.
Is there any way to add code review work flows for scripting in Jenkins Jobs?
if you want to keep your Jenkins job scripts under version control and review it you have to use pipeline job type - since that is based on a groovy script, which can be stored in the git repository. So in this way if a new patchset is created on the script gerrit can trigger the pipeline job which is based on that script.

Global Jenkins script that will be executed before a build is started

I'm searching for a way to execute automatically a global configured script BEFORE a Jenkins job will be started.
My use case is, all Jenkins jobs are only allowed to start if a specific environment variable is set.
If a variable is not set, the build should be aborted.
I found the Global Post Plugin https://wiki.jenkins.io/display/JENKINS/Global+Post+Script+Plugin, i only need the oposite what this Plugin does.
Maybe there's another solution?
I needed to chmod my /data/jenkins/.npm and /data/jenkins/.sbt directories before running all my builds.
I could either add a prebuild step to every job (redundant and messy) or I could go under Manage Jenkins -> Configure System.
We have a Cloud -> Amazon EC2 configuration section with "Init script" - you can add what you want to run there on slave startup.
However, if you really want something to run something for every job (not enough to run on jenkins slave startup) then you probably don't want to manually configure it for each job.
I suggest you look into Jenkins DSL as you can define preBuildSteps section on any/all job(s) which can then reference a common snippet (eg. a shell script to run).
Partial Solution:
Take a look at the Global Pre Script plugin. This plugin is less feature-rich than the Global Post Script plugin, but it should do at least a part of what you want. It notably lacks the option to abort the build, but it is able to manipulate parameters or other preconditions that your jobs rely on. You may also be able to submit a PR to add some means of preventing the build from executing.
Some options:
Modify Global Pre Script to be able to cleanly abort the build from groovy.
Change your existing jobs to check for a precondition (manually or via script). This not the most scalable option.
Replace your existing jobs with Pipeline jobs and use Shared Libraries to bottleneck the logic. (This is what I do).
Generate your jobs using the Job DSL Plugin and enforce a pre build step in every generated job. (This is what I also do)
Limitations:
Something to keep in mind for both global plugins: neither plugin provides a proper build step. The groovy code executes on the master.
One use case that neither plugin will handle is a between-job slave cleanup/sanity check.

Is there a way to turn Jenkins job into a Jenkins DSL script automatically?

I use Job DSL Plugin to generate my Jenkins builds. But sometimes I make small changes to the build in Jenkins and I want to port those changes back to my DSL script automatically. Is there any way to achieve this?
Currently there is no way to generate a Job DSL script for an existing job. This has been reported in the Jenkins issue tracker as JENKINS-16360 some time ago and someone even offered a bounty, but AFAIK no one is working on the issue.

Build Pipeline Plugin & Manual Deployment With Parameter

Let's say I have this situation. I have three jobs. Job number one has two manually triggered downstream jobs (deploy to test, deploy to prod for example). Something like this:
I want the deployment jobs (test-job-2, test-job-3) to require a password before they are triggered. How can I solve this with Jenkins?
The only option right now supported by the Build Pipeline Plugin is to have a manually deployed downstream job. But this job starts right after you click on it. I would like to require the user to manually enter some parameters (password for example).
Is there some workaround? I was thinking of using the Promoted Builds Plugin. So the deployment jobs would run in a "dry run mode" - just checking that we have ssh access to the server and some other basic stuff. And then in order to deploy you will have to promote the build.
This approach isn't very nice though. Build pipeline and promoted builds plugins don't interact with each other very well.
This is not exactly what you want, but I guess it would some how solve your problem.
View Job Filters
Using this feature in tandem with a security feature such as the Standard matrix based security can help you create a view that will show different jobs depending on who is logged in.
I use different Jenkins Servers to "complete the pipeline" using Build Publisher job to publish the last part of the pipeline job to the other jenkins. I then pick it up from there. Operations teams have access to the "prod" jenkins system, and developers have access to the "dev" system.

Resources