Chapter 24: Jenkins with GitHub, GitLab and Bitbucket

24.7 What not to do

By Ravindra Bagale · Last updated: 25 October 2026

Why: the problem

Think of a bank like HDFC. A security review finds three problems in one week. First, a Jenkinsfile on a public repo had a GitLab token typed in it. A bot found it in minutes. Second, a contractor opened a pull request from a fork. The PR changed the Jenkinsfile to run "aws s3 ls" on the main Jenkins agent, which had admin rights in the cloud account. Third, someone "fixed" missing webhooks by pasting a made-up URL, so no builds ran for two days and nobody knew. None of these need clever hackers. They are simple mistakes. In this lesson you will make each mistake in a safe lab, see how it is found, and fix it the right way.

What we will build

You will scan a repo for leaked tokens with gitleaks and fix a leak by rotating the token, not just deleting the line. You will set the Multibranch job to trust only PRs from people with write access, and run PR builds on a small agent with no cloud rights. You will add a check job that alerts when no build has run on main for a day, so a broken webhook is noticed. You will finish with a short checklist you can use in any company.

What: every term in plain English

• Secret leak — A token, password or key that ends up in Git, a log or a chat.
• gitleaks — A free tool that scans Git history for secrets.
• Rotate — Make a new secret and turn off the old one. Deleting the line is not enough; history keeps it.
• Fork PR — A pull request from a copy of the repo owned by someone outside the team.
• Trust setting — A Multibranch behaviour that decides whose Jenkinsfile changes are used in PR builds.
• Least privilege — Give each agent and token only the access it needs, nothing more.
• Agent label — A name on an agent, like pr-small, so jobs can pick where they run.
• Silent failure — Something is broken but no alert fires, like a dead webhook.

How: step by step

1. Install gitleaks

   docker pull zricethezav/gitleaks:latest
   

   What it does: Gets the scanner as a container. No install on the laptop.

   Output

   Status: Downloaded newer image for zricethezav/gitleaks:latest
   

2. Scan the repo history

   docker run --rm -v "$PWD":/repo zricethezav/gitleaks:latest detect --source /repo -v
   

   What it does: Looks at every commit for secret patterns.

   Output

   Finding:     token = "glpat-XXXXXXXXXXXXXXXXXXXX"
   RuleID:      gitlab-pat
   Commit:      2f9c0aa
   1 leaks found
   

3. Rotate the token

   GitLab > Access tokens > Revoke old > Create new > update credential gl-read
   

   What it does: The leaked value is now useless.

   Output

   Token revoked
   

4. Remove it from the file

   Replace the token line with credentialsId: 'gl-read' and commit
   

   What it does: Future commits are clean. The old commit is harmless after rotation.

   Output

   [main 7e1d3b2] use credential id
   

5. Set PR trust

   menu-api-mb > Configure > Discover merge requests from forks > Trust: Members
   

   What it does: Fork PRs from outsiders use the Jenkinsfile from the target branch, not their changed one.

   Output

   (saved)
   

6. Add a small PR agent

   Manage Jenkins > Nodes > New node > pr-small > Labels: pr-small > no cloud role
   

   What it does: PR builds run here, away from deploy rights.

   Output

   Agent pr-small is connected
   

7. Add a "no builds" alert job

   New Item > main-heartbeat > Pipeline > runs daily
   

   What it does: Finds silent webhook failures.

   Output

   Job main-heartbeat created
   

Example 1: Wrong and right: a token in the Jenkinsfile vs a credential id

Stack. gitleaks, Jenkins credentials

Goal. Wrong and right: a token in the Jenkinsfile vs a credential id.

Jenkinsfile (wrong, never do this)

pipeline {
  agent any
  environment { GL_TOKEN = 'glpat-XXXXXXXXXXXXXXXXXXXX' }
  stages {
    stage('Clone') {
      steps { sh 'git clone https://ci:$GL_TOKEN@gitlab.com/shop-food/menu-api.git' }
    }
  }
}

Jenkinsfile (right)

pipeline {
  agent any
  stages {
    stage('Clone') {
      steps {
        git url: 'https://gitlab.com/shop-food/menu-api.git', branch: 'main', credentialsId: 'gl-read'
      }
    }
  }
}

What each line does

• GL_TOKEN = 'glpat-...' — Wrong. The token is now in Git history for everyone who can read the repo.
• git clone https://ci:$GL_TOKEN@... — Wrong. The URL with the token can show up in logs and process lists.
• credentialsId: 'gl-read' — Right. Only the id is in Git. The secret stays in Jenkins.
• git step — Right. The Git plugin handles the login and masks it.

Green output

Wrong version, gitleaks:
Finding: GL_TOKEN = 'glpat-XXXXXXXXXXXXXXXXXXXX'
1 leaks found

Right version, gitleaks:
INF no leaks found

Expected result. The scan is clean, the old token is revoked, and the build still works with gl-read.

Example 2: Run PR builds on a small agent and deploys on a separate agent

Stack. Jenkins agents with labels

Goal. Run PR builds on a small agent and deploys on a separate agent.

Jenkinsfile

pipeline {
  agent none
  stages {
    stage('Test') {
      agent { label env.CHANGE_ID ? 'pr-small' : 'linux-docker' }
      steps { sh 'npm ci || npm install'; sh 'npm test' }
    }
    stage('Deploy') {
      when { branch 'main' }
      agent { label 'deploy' }
      steps {
        withCredentials([string(credentialsId: 'prod-deploy-key', variable: 'DEPLOY_KEY')]) {
          sh './deploy.sh'
        }
      }
    }
  }
}

What each line does

• agent none — No default agent. Each stage picks its own.
• label env.CHANGE_ID ? 'pr-small' : 'linux-docker' — PR builds go to the small agent without cloud rights.
• when { branch 'main' } — Deploy never runs for PRs.
• agent { label 'deploy' } — Only this agent has the deploy role.
• credentialsId: 'prod-deploy-key' — Production secret used only in the deploy stage on main. Scope the credential to this folder.

Green output

menu-api-mb/MR-4 #1
Running on pr-small in /home/jenkins/workspace/menu-api-mb_MR-4
menu ok
Stage "Deploy" skipped due to when conditional
Finished: SUCCESS

Expected result. A PR, even a bad one, can only reach the small agent. It has no cloud role and no production secrets.

Example 3: Catch a silent webhook failure: alert if main has not built in 24 hours

Stack. Jenkins scripted check, email

Goal. Catch a silent webhook failure: alert if main has not built in 24 hours.

Jenkinsfile (main-heartbeat job)

pipeline {
  agent any
  triggers { cron('H 9 * * *') }
  stages {
    stage('Check last main build') {
      steps {
        script {
          def j = Jenkins.instance.getItemByFullName('menu-api-mb/main')
          def last = j?.lastBuild
          def hours = last ? (System.currentTimeMillis() - last.getTimeInMillis()) / 3600000 : 9999
          echo "Last main build: ${last?.number} , ${hours as int} hours ago"
          if (hours > 24) { error("No main build for ${hours as int} hours. Check the webhook.") }
        }
      }
    }
  }
  post { failure { mail to: 'devops-team@shop.local', subject: 'menu-api main is quiet', body: "${env.BUILD_URL}" } }
}

What each line does

• cron('H 9 * * *') — Runs once a day near 9 AM.
• getItemByFullName('menu-api-mb/main') — Finds the main child job. Needs script approval once by an admin.
• lastBuild.getTimeInMillis() — The start time of the last build.
• if (hours > 24) error(...) — Fails the job, which makes the mail go out.
• mail to: ... — Sends an alert. You can use Slack or Teams plugins instead.

Green output

Last main build: 41 , 31 hours ago
ERROR: No main build for 31 hours. Check the webhook.
Sending email to: devops-team@shop.local
Finished: FAILURE

Expected result. The team learns about the broken webhook the next morning, not after a week.

Verify: did it work?

1. Scan again for secrets

   docker run --rm -v "$PWD":/repo zricethezav/gitleaks:latest detect --source /repo --no-git
   

   What it does: Scans the current files only.

   Output

   INF no leaks found
   

2. Check where a PR ran

   curl -s -u ravi:$JENKINS_TOKEN "http://localhost:8080/job/menu-api-mb/job/MR-4/lastBuild/consoleText" | grep "Running on"
   

   What it does: Must show pr-small.

   Output

   Running on pr-small in /home/jenkins/workspace/menu-api-mb_MR-4
   

When it is red 1

Fork PR build ran: aws s3 ls
2026-10-20 prod-backups
2026-10-20 customer-exports

Cause. A fork PR changed the Jenkinsfile, and the agent had cloud admin rights.

Fix, step by step

1. Set fork PR trust to Members or Nobody.
2. Move PR builds to pr-small with no role.
3. Rotate any secret the agent could reach.

When it is red 2

gitleaks: 1 leaks found (after you deleted the line)

Cause. The secret is still in old commits.

Fix, step by step

1. Rotate the secret first.
2. Then optionally rewrite history with the security team.
3. Add gitleaks as a PR stage so it never happens again.

When it is red 3

Builds stopped for two days, webhook page shows: Hook executed: 404 Not Found https://jenkins.example.invalid/project/menu-api

Cause. Someone pasted a made-up URL.

Fix, step by step

1. Use the real reachable Jenkins URL or Poll SCM.
2. Test with Push events and see 200.
3. Keep the heartbeat job on.

Cleanup

1. Remove the lab agent

   Manage Jenkins > Nodes > pr-small > Delete Agent
   

   What it does: Keeps the lab Jenkins tidy.

   Output

   Agent pr-small deleted
   

2. Remove the gitleaks image

   docker rmi zricethezav/gitleaks:latest
   

   What it does: Frees disk space.

   Output

   Untagged: zricethezav/gitleaks:latest
   

Practice tasks

Homework: try at home

Recap

• Never put tokens in a Jenkinsfile; use credential ids.
• If a secret leaks, rotate it first.
• Do not let untrusted PRs run with powerful agents or secrets.
• Never invent webhook URLs; use polling or a real URL.
• Add a heartbeat check to catch silent failures.

FAQ

Is a private repo safe for tokens?

No. Many people and tools can read it, and it may become public later.

Can Jenkins mask every secret?

It masks values used through withCredentials. It cannot mask secrets you typed in plain text.

Should I build fork PRs at all?

Yes for open source, but with trust rules and a small agent.

What if I need a webhook on a laptop?

Use a short tunnel for a lab, then stop it.

Who should own the Jenkins bot account?

The team, not one person, so it keeps working when people leave.

Interview questions

1. How do you handle a leaked token in Git?

   Revoke and rotate it at once, replace it with a credential id, scan history, and add a secret scan stage.

2. How do you build PRs from forks safely?

   Trust only members for Jenkinsfile changes, run on a small agent with no secrets, and never deploy from PRs.

3. What is least privilege for Jenkins agents?

   Each agent has only the rights its jobs need. PR agents have none; deploy agents have only deploy rights.

4. How do you detect that webhooks stopped?

   A heartbeat job or monitor that alerts when no build ran for a set time, plus the host delivery log.

5. Name three Jenkins anti-patterns with Git hosts.

   Tokens in Jenkinsfiles, untrusted PRs on powerful agents, and fake or unreachable webhook URLs.

Samajla ka?

Ravi Sir's Cards for this lesson

Revision cardInterview card

मराठी cards