Chapter 22: Jenkins Language Projects — Java to Python

22.11 Safety and honesty checklist

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

Think of a Paytm release night. A pipeline went green, the team deployed, and users saw errors. Later they found the truth: the test stage had || true at the end, so failing tests never turned the build red. Another team printed an API key in the console log, and anyone with Jenkins read access could copy it. Green must mean real, and logs must be safe. This last lesson is a checklist you run on every language pipeline from this chapter. It covers honest results (no skipped tests, no fake green), safe secrets (credentials, masking), safe files (nothing writable by everyone, no root containers), and clean agents. Each check has a command you can run, so it is not just advice.

What we will build

You will scan your Jenkinsfiles for fake-green patterns, move a secret into Jenkins credentials with withCredentials, check that tests really fail the build, clean workspaces, and run a one-command audit over all six projects.

What: every term in plain English

• Fake green — A build that passes even when something failed.
• || true — Shell trick that hides a failure. Only for reports, never for tests.
• withCredentials — Jenkins step that gives a secret to a block and masks it in logs.
• Masking — Jenkins replaces the secret with **** in the console.
• cleanWs — Delete the workspace after the build.
• Least privilege — Give only the access a job needs.
• Non-root container — App runs as a normal user.
• Audit — A repeatable check you run often.

How: step by step

1. Find fake green

   grep -rn "|| true" ~/devops-lab/ch22/*/Jenkinsfile
   

   What it does: Look at each hit.

   Output

   badge-java/Jenkinsfile:12: sh 'mvn -B test || true'
   

2. Find skipped tests

   grep -rn "skipTests\|-DskipTests" ~/devops-lab/ch22/*/Jenkinsfile
   

   What it does: Allowed only in a Package stage after Test.

   Output

   badge-java/Jenkinsfile:9: sh 'mvn -B -DskipTests package'
   

3. Find secrets in Git

   grep -rniE "password|secret|api_key|token" ~/devops-lab/ch22 --include=*.{groovy,yml,properties,json,py,js} | grep -v credentials
   

   What it does: Should be empty.

   Output

   (no output)
   

4. Find world-writable chmod

   grep -rnE "chmod (-R )?0?7{3}" ~/devops-lab/ch22
   

   What it does: Must be empty.

   Output

   (no output)
   

5. Find root containers

   grep -L "^USER" ~/devops-lab/ch22/*/Dockerfile
   

   What it does: Files without a USER line.

   Output

   (no output)
   

6. Check cleanup

   grep -c "cleanWs" ~/devops-lab/ch22/*/Jenkinsfile
   

   What it does: At least 1 each.

   Output

   badge-java/Jenkinsfile:1
   

7. Save the checklist

   cp checklist.md ~/devops-lab/ch22/
   

   What it does: Reuse it.

   Output

   (no output)
   

Example 1: Fix a fake-green test stage

Stack. Jenkins

Goal. Fix a fake-green test stage.

before

stage('Test') { steps { sh 'mvn -B test || true' } }

after

stage('Test') { steps { sh 'mvn -B test' } }
post { always { junit 'target/surefire-reports/*.xml' } }

What each line does

• || true — Turns every failure into success. Remove it.
• junit in post always — Reports still publish when tests fail.

Green output

Before: Tests run: 3, Failures: 1 ... Finished: SUCCESS
After:  Tests run: 3, Failures: 1 ... Finished: UNSTABLE

Expected result. Now a failing test is visible. UNSTABLE (yellow) or FAILURE (red) stops the release.

Example 2: Use a secret safely with withCredentials

Stack. Jenkins Credentials

Goal. Use a secret safely with withCredentials.

Jenkinsfile

stage('Notify') {
  steps {
    withCredentials([string(credentialsId: 'badge-api-key', variable: 'API_KEY')]) {
      sh 'curl -fs -H "Authorization: Bearer $API_KEY" https://api.example.com/deploys -d "app=badge&build=$BUILD_NUMBER"'
    }
  }
}

What each line does

• credentialsId — Secret saved in Manage Jenkins, Credentials.
• variable — Name inside the block only.
• single quotes in sh — Groovy does not insert the secret into the script text; the shell reads it from the environment.

Green output

+ curl -fs -H "Authorization: Bearer ****" https://api.example.com/deploys -d app=badge&build=21
Finished: SUCCESS

Expected result. The key never appears in Git or in the log.

Example 3: Prove tests can fail the build

Stack. pytest

Goal. Prove tests can fail the build.

prove.sh

cd ~/devops-lab/ch22/badge-python
. .venv/bin/activate
sed -i 's/>= 100/> 100/' app.py
pytest -q; echo "exit=$?"
git checkout -- app.py

What each line does

• Break on purpose — Change the rule.
• echo exit — Non-zero means CI would go red.
• git checkout -- — Undo the change.

Green output

FAILED tests/test_app.py::test_level[100-gold] - AssertionError
1 failed, 3 passed in 0.22s
exit=1

Expected result. If this printed exit=0, your tests are not testing anything.

Example 4: One audit script for all projects

Stack. Bash

Goal. One audit script for all projects.

audit.sh

#!/usr/bin/env bash
cd ~/devops-lab/ch22
bad=0
for f in */Jenkinsfile; do
  grep -q "|| true" "$f" && grep -n "|| true" "$f" | grep -qiE "test|pytest|phpunit|mvn|gradlew" && { echo "FAKE-GREEN $f"; bad=1; }
  grep -q "cleanWs" "$f" || echo "NO-CLEANUP $f"
done
for d in */Dockerfile; do grep -q "^USER" "$d" || { echo "ROOT $d"; bad=1; }; done
grep -rqE "chmod (-R )?0?7{3}" . && { echo "WORLD-WRITABLE chmod found"; bad=1; }
[ "$bad" = 0 ] && echo "AUDIT PASS" || { echo "AUDIT FAIL"; exit 1; }

What each line does

• for f in */Jenkinsfile — Check every project.
• FAKE-GREEN — || true on a test line.
• NO-CLEANUP — Warn only.
• ROOT — Dockerfile without USER.
• exit 1 — Use this script as a Jenkins stage too.

Green output

NO-CLEANUP badge-php/Jenkinsfile
AUDIT PASS

Expected result. Run it before every release review.

Verify: did it work?

1. Audit passes

   bash audit.sh; echo $?
   

   What it does: Zero.

   Output

   AUDIT PASS
   0
   

2. Mask works

   grep -c "\*\*\*\*" console.txt
   

   What it does: Secret masked.

   Output

   1
   

3. Workspace cleaned

   ls /var/lib/jenkins/workspace/badge-python-pipeline 2>/dev/null | wc -l
   

   What it does: Empty after cleanWs.

   Output

   0
   

When it is red 1

Warning: A secret was passed to "sh" using Groovy String interpolation, which is insecure.

Cause. You used double quotes with ${API_KEY} in Groovy.

Fix, step by step

1. Use single quotes so the shell reads $API_KEY from the environment.

When it is red 2

ERROR: Could not find credentials entry with ID 'badge-api-key'

Cause. Wrong ID or the job folder cannot see it.

Fix, step by step

1. Check the ID in Manage Jenkins, Credentials.
2. Store it at the folder or global level.

When it is red 3

Finished: SUCCESS (but Tests run: 3, Failures: 1 above)

Cause. A || true or returnStatus hides failures.

Fix, step by step

1. Remove || true from test commands.

When it is red 4

No space left on device

Cause. Old workspaces and images fill the agent disk.

Fix, step by step

1. Add cleanWs in post.
2. docker system prune -f on a schedule.

Cleanup

1. Remove lab logs

   rm -f ~/devops-lab/ch22/*.log
   

   What it does: Done with the chapter.

   Output

   (no output)
   

Practice tasks

Homework: try at home

Recap

• Green must mean every test ran and passed.
• Never || true on tests.
• Secrets via withCredentials, single quotes.
• No world-writable files, no root containers.
• Clean workspaces and run an audit.

FAQ

Is || true ever OK?

Only for optional reporting commands, never for build or tests.

UNSTABLE vs FAILURE?

UNSTABLE: tests failed but reports published. FAILURE: a step crashed. Both should block release.

Can Jenkins mask every secret?

Only those given through credentials. Secrets printed in other ways leak.

Where should .env files live?

On the server or in a secret manager, not in Git.

Should every job clean the workspace?

Yes on shared agents, unless you rely on a cache folder.

Who reviews Jenkinsfiles?

The same reviewers as code, through merge requests.

Interview questions

1. How do you make sure a pipeline is not fake green?

   No || true on tests, publish reports, plant a failing test to prove it turns red.

2. How do you handle secrets in Jenkins?

   Credentials store plus withCredentials, single-quoted sh, no echo.

3. What is the Groovy interpolation warning?

   Secrets in double-quoted Groovy strings leak into the process list and logs.

4. How do you keep agents healthy?

   cleanWs, docker prune, disk alerts.

5. What security checks do you add to CI?

   Secret scanning, lint, non-root images, dependency scans.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards