Chapter 80: DevOps Projects Part 10: Jenkins Agents Freestyle Pipeline Webhook Sonar ECR EKS Approval Libraries Backup

80.9 Project 75: Shared libraries for many teams

By Ravindra Bagale Last updated: 28 October 2026

Friends, copy-paste Jenkinsfiles drift. Today we create a shared library repo, write a vars step, load it in a Jenkinsfile, and version the library.

What you will build in this project

Create a shared library layout.
Write a vars/deployApp.groovy step.
Load the library in a Jenkinsfile.
Pin a library version.

1. Start from a real company story

At Accenture in Pune, twelve teams each pasted a different deploy script and one used the wrong namespace.

Prod got a staging image. Rough cost: about ₹18 lakh in cleanup and trust repair.

Nisha built one shared library and forced @Library versions.

Today we build that library.

Picture 1: lib repo vars/ → Jenkins Global Libraries → Jenkinsfile @Library → call deployApp

Ravindra Bagale's Tip

Students use a dynamic library without a version so yesterday is not reproducible. Pin tags or SHAs. Keep that habit.

2. Start and prepare

Step 1: Why shared libs

Why: Duplicated Jenkinsfiles drift. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: echo why. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 1: a1

Type this:

echo 'Shared library = one tested deploy step for many repos'

You will see:

Shared library = one tested deploy step for many repos

What it means: Why.

Example 2: a2

Type this:

mkdir -p /tmp/jen75/shop-lib/vars /tmp/jen75/shop-lib/src/com/shop && ls /tmp/jen75/shop-lib

You will see:

src\nvars

What it means: Layout.

Example 3: a3

Type this:

echo 'Today: vars step, Global Library, @Library pin'

You will see:

Today: vars step, Global Library, @Library pin

What it means: Scope.

Step 2: vars step

Why: deployApp.groovy. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: printf groovy. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 4: b1

Type this:

printf '%s\n' 'def call(Map cfg) {' '  def ns = cfg.namespace ?: \'shop\'' '  def name = cfg.name ?: error(\'name required\')' '  def image = cfg.image ?: error(\'image required\')' '  sh "kubectl -n ${ns} set image deploy/${name} ${name}=${image}"' '  sh "kubectl -n ${ns} rollout status deploy/${name} --timeout=180s"' '}' > /tmp/jen75/shop-lib/vars/deployApp.groovy && cat /tmp/jen75/shop-lib/vars/deployApp.groovy

You will see:

def call(Map cfg) {

What it means: Groovy.

Example 5: b2

Type this:

echo 'File name deployApp.groovy becomes step deployApp()'

You will see:

File name deployApp.groovy becomes step deployApp()

What it means: Naming.

Example 6: b3

Type this:

echo 'error() fails fast when required keys are missing'

You will see:

error() fails fast when required keys are missing

What it means: Validate.

Step 3: src classes

Why: Optional helpers. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: src tree. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 7: c1

Type this:

printf '%s\n' 'package com.shop' 'class ImageRef {' '  static String ecr(String account, String region, String repo, String sha) {' '    return "${account}.dkr.ecr.${region}.amazonaws.com/${repo}:${sha}"' '  }' '}' > /tmp/jen75/shop-lib/src/com/shop/ImageRef.groovy && cat /tmp/jen75/shop-lib/src/com/shop/ImageRef.groovy

You will see:

package com.shop

What it means: Class.

Example 8: c2

Type this:

echo 'Prefer thin vars that call small classes'

You will see:

Prefer thin vars that call small classes

What it means: Style.

Example 9: c3

Type this:

echo 'Unit-test Groovy with JenkinsPipelineUnit when the lib grows'

You will see:

Unit-test Groovy with JenkinsPipelineUnit when the lib grows

What it means: Test tip.

3. Build the main pieces

Step 4: Global Library

Why: Jenkins config. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: UI tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 10: d1

Type this:

printf '%s\n' 'Manage Jenkins -> System -> Global Pipeline Libraries' 'Name: shop-lib' 'Default version: main' 'Retrieval: Modern SCM -> your lib repo' 'Allow default version to be overridden: yes' > /tmp/jen75/GLOBAL.txt && cat /tmp/jen75/GLOBAL.txt

You will see:

Name: shop-lib

What it means: Global.

Example 11: d2

Type this:

echo 'Load implicitly only if you trust every job; prefer explicit @Library'

You will see:

Load implicitly only if you trust every job; prefer explicit @Library

What it means: Explicit.

Example 12: d3

Type this:

echo 'Separate staging-lib and prod-lib names if policies differ'

You will see:

Separate staging-lib and prod-lib names if policies differ

What it means: Split.

Step 5: Jenkinsfile use

Why: Call the step. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: consumer. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 13: e1

Type this:

printf '%s\n' '@Library(\'shop-lib@1.4.0\') _' 'pipeline {' '  agent { label \'docker\' }' '  stages {' '    stage(\'Deploy\') {' '      steps {' '        script { deployApp(namespace: \'shop\', name: \'cart\', image: env.IMAGE) }' '      }' '    }' '  }' '}' > /tmp/jen75/Jenkinsfile && cat /tmp/jen75/Jenkinsfile

You will see:

@Library('shop-lib@1.4.0') _

What it means: Consumer.

Example 14: e2

Type this:

echo 'The underscore after @Library loads the lib without a named import'

You will see:

The underscore after @Library loads the lib without a named import

What it means: Underscore.

Example 15: e3

Type this:

echo 'IMAGE env should be the ECR URI:SHA from earlier stages'

You will see:

IMAGE env should be the ECR URI:SHA from earlier stages

What it means: IMAGE.

Step 6: Version pin

Why: Tags beat branches. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: semver tip. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 16: f1

Type this:

printf '%s\n' 'git tag 1.4.0 && git push origin 1.4.0' 'Jenkinsfile uses shop-lib@1.4.0' > /tmp/jen75/VERSION.txt && cat /tmp/jen75/VERSION.txt

You will see:

Jenkinsfile uses shop-lib@1.4.0

What it means: Pin.

Example 17: f2

Type this:

echo 'Branches float; tags stay still — pin tags for prod'

You will see:

Branches float; tags stay still — pin tags for prod

What it means: Why tag.

Example 18: f3

Type this:

echo 'Bump minor when you add a safe step; major when call() args break'

You will see:

Bump minor when you add a safe step; major when call() args break

What it means: Semver.

4. Automate and verify

Step 7: PR review

Why: Lib changes are global. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: process. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 19: g1

Type this:

printf '%s\n' 'Every lib PR needs a second reviewer' 'Run a canary job on a non-prod service before merging' > /tmp/jen75/REVIEW.txt && cat /tmp/jen75/REVIEW.txt

You will see:

Every lib PR needs a second reviewer

What it means: Review.

Example 20: g2

Type this:

echo 'Changelog in the lib repo for every tag'

You will see:

Changelog in the lib repo for every tag

What it means: Changelog.

Example 21: g3

Type this:

echo 'Announce breaking changes in the team channel before tagging major'

You will see:

Announce breaking changes in the team channel before tagging major

What it means: Announce.

Step 8: No secrets

Why: Library is public to jobs. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: secret rule. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 22: h1

Type this:

echo 'Never hardcode tokens inside vars/*.groovy'

You will see:

Never hardcode tokens inside vars/*.groovy

What it means: Rule.

Example 23: h2

Type this:

echo 'Accept credential IDs as parameters; bind in the caller'

You will see:

Accept credential IDs as parameters; bind in the caller

What it means: Pattern.

Example 24: h3

Type this:

printf '%s\n' 'Bad: token = "AKIA..."' 'Good: withCredentials in the Jenkinsfile or a param id' > /tmp/jen75/SECRETS.txt && cat /tmp/jen75/SECRETS.txt

You will see:

Good: withCredentials in the Jenkinsfile or a param id

What it means: Example.

Step 9: Resource tips

Why: src vs vars. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: when to use. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 25: i1

Type this:

printf '%s\n' 'vars: simple call() steps teams invoke' 'src: reusable classes and non-step helpers' 'resources/: shell or yaml templates loaded with libraryResource' > /tmp/jen75/LAYOUT.txt && cat /tmp/jen75/LAYOUT.txt

You will see:

vars: simple call() steps teams invoke

What it means: Layout tip.

Example 26: i2

Type this:

echo 'Keep call() argument maps documented at the top of the file'

You will see:

Keep call() argument maps documented at the top of the file

What it means: Docs.

Example 27: i3

Type this:

echo 'Avoid CPS pitfalls: mark non-serializable fields @NonCPS carefully'

You will see:

Avoid CPS pitfalls: mark non-serializable fields @NonCPS carefully

What it means: CPS tip.

5. Harden and accept

Step 10: Story Accenture

Why: Pune paste drift. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: story. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 28: j1

Type this:

printf '%s\n' 'At Accenture in Pune, twelve teams pasted different deploy scripts and one hit the wrong namespace.' 'Nisha built shop-lib and forced @Library versions.' > /tmp/jen75/STORY.txt && wc -l /tmp/jen75/STORY.txt

You will see:

2 /tmp/jen75/STORY.txt

What it means: Story.

Example 29: j2

Type this:

echo 'Rough cost: about ₹18 lakh in cleanup and trust repair'

You will see:

Rough cost: about ₹18 lakh in cleanup and trust repair

What it means: Cost.

Example 30: j3

Type this:

echo 'Nisha: PASS'

You will see:

Nisha: PASS

What it means: Sign-off.

Step 11: Proof

Why: Lib tree. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: ls. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 31: k1

Type this:

ls /tmp/jen75/shop-lib/vars /tmp/jen75

You will see:

/tmp/jen75/shop-lib/vars:\ndeployApp.groovy\n\n/tmp/jen75:\nGLOBAL.txt\nJenkinsfile\nLAYOUT.txt\nREVIEW.txt\nSECRETS.txt\nSTORY.txt\nVERSION.txt\nshop-lib

What it means: Tree.

Example 32: k2

Type this:

grep @Library /tmp/jen75/Jenkinsfile

You will see:

@Library('shop-lib@1.4.0') _

What it means: Pin line.

Example 33: k3

Type this:

echo 'Next: Jenkins backup and restore project 76'

You will see:

Next: Jenkins backup and restore project 76

What it means: Bridge.

Step 12: Acceptance

Why: Library callable and pinned. We do this before the next step so mistakes stay small and easy to undo. Read the output carefully; the numbers and names tell you if the machine is healthy.

What: final. Follow the numbered examples below. Type each command, read the exact output, and match the meaning line before you move on. That is how real teams learn a tool.

Example 34: z1

Type this:

echo 'deployApp var exists'

You will see:

deployApp var exists

What it means: Var.

Example 35: z2

Type this:

echo 'Jenkinsfile pins shop-lib@1.4.0'

You will see:

Jenkinsfile pins shop-lib@1.4.0

What it means: Pin.

Example 36: z3

Type this:

echo 'No secrets in groovy'

You will see:

No secrets in groovy

What it means: Secrets.

Check yourself

Q1. Who fixed Accenture paste drift?

Nisha

Q2. Folder for steps?

vars

Q3. Annotation?

@Library

Q4. Pin with?

tag or SHA

Q5. Call style?

deployApp()

Q6. Secrets in lib?

Friends, you shared one library across teams. Did you understand? Let us try it once more. Add a vars/smokeUrl.groovy helper and call it from the Jenkinsfile.

Lab: try at home

Scaffold lib repo.
Write deployApp.
Configure Global Library.
Pin version in Jenkinsfile.

Recap

One library many teams.
vars are callable steps.
Pin versions.
Review library PRs.
No secrets in lib.