jenkins
2 guardrails, all at version v1.
| Guardrail | Default severity | What it checks |
|---|---|---|
jenkins/job-timeout-set | info | Every declarative pipeline declares how long it may run, on the pipeline itself or on every stage, so a hung build is cut off rather than holding an executor. |
jenkins/shared-library-pinned | error | Every @Library annotation and library step names a tag or a commit sha rather than a branch, so the library code a build runs cannot change underneath it. |
Shared inputs
Every jenkins guardrail declares these inputs, and each one may add its own.
| Input | Description | Default |
|---|---|---|
jenkinsfiles | Comma separated globs naming the Jenkinsfiles to read. | Jenkinsfile,Jenkinsfile.*,*.Jenkinsfile |
Shared collectors
Every jenkins guardrail is handed the facts these collectors gather, and each one may ask for more of its own.
| Collector | Gathers |
|---|---|
jenkins | The Jenkinsfiles the repository carries, read in Jenkins's own vocabulary: whether each is a declarative pipeline or a scripted one, the agent it asks for, the stages in the order they are declared with the steps inside them, the timeouts its options blocks declare, the shared libraries it loads and how tightly each is pinned, and the credential ids it reaches for. A Jenkinsfile is Groovy rather than a declaration, so it is read by pattern and scanned says so. Names and ids only, never a credential, an environment value or a parameter value. |
Every guardrail in this category is configured the same way, in the guardrails.checks array of buildnote.json. See Configuring guardrails for every option, and Guardrails to search the whole library.