Jenkins pipelines, agents, credentials and deployment gates

Why and what

Continuous integration validates changes frequently. Continuous delivery keeps a releasable artifact ready; continuous deployment automatically releases passing changes under the chosen controls. Jenkins runs pipelines on agents. A controller should coordinate rather than serve as an unrestricted shared build machine.

Setup sequence

1. Install a supported Jenkins release and its required Java version using official instructions; requirements change with releases.
2. Keep initial access restricted, complete setup, use named accounts and configure authentication/authorization.
3. Create an isolated agent with required tools. Avoid running untrusted builds with production credentials or the host Docker socket.
4. Create a pipeline job from a repository you control and store Jenkinsfile in source.

Example pipeline

pipeline {
  agent any
  options { timestamps(); disableConcurrentBuilds() }
  stages {
    stage('Checkout') { steps { checkout scm } }
    stage('Validate') {
      steps { sh 'python3 build.py --check' }
    }
    stage('Build') {
      steps { sh 'python3 build.py' }
    }
    stage('Archive') {
      steps { archiveArtifacts artifacts: 'site/**', fingerprint: true }
    }
  }
}

This pipeline builds the course package when its build.py is present; it does not deploy automatically. Add deployment only after defining the target, access method, release directory and rollback behaviour. Agent tools must exist; Jenkins does not install project dependencies magically.

Credentials

Reference approved Jenkins credential IDs or short-lived workload identity. Do not print secrets, use Groovy interpolation around secret values or let untrusted pull requests read deployment credentials. Masking reduces accidental display but cannot defend against malicious build scripts with secret access.

Release flow

Build once, identify the artifact by commit/digest, test it and promote that artifact. For EC2, copy to a versioned release directory, verify it, switch the active path and health-check. Keep the previous release for rollback. Database changes require backward-compatible migration planning beyond a symlink swap.

Verification and assignment

Introduce a deliberate build error in a feature branch and confirm the pipeline stops before release. Restore it, archive a passing build and identify its commit. Explain why “job green” is insufficient if the deployed application was never checked.

Official references

Jenkins installation Jenkinsfile

Interview and revision check

Why not run untrusted builds with production credentials?

Build code can use or exfiltrate credentials available to it. Masking logs is not a security boundary against malicious scripts.