I’m Tracy Miranda, and I’m really excited to have joined CloudBees this month leading the open source program. CloudBees’ contributions to Jenkins include developing Pipeline and Blue Ocean, staffing the infrastructure team, advocacy and events work, as well as security efforts. My focus is on making sure there is a great relationship between the Jenkins community and CloudBees, which means strong communication, help get...

One common pattern for automated releases I have seen and used relies on Git tags as the catalyst for a release process. The immutable nature of releases and the immutable nature of tags can definitely go hand in hand, but up until few months ago Jenkins Pipeline was not able to trigger effectively off of Git tags. In this post I want to briefly share how to use tags...

A couple of weeks ago, Tyler mentioned some developer improvements in Essentials that had been recently introduced: the ability for ci.jenkins.io builds to get deployed automatically to an “Incrementals” Maven repository, as described in JEP-305. For a plugin maintainer, you just need to turn on this support and you are ready to both deploy individual Git commits from your repository without the need to run heavyweight traditional Maven releases, and to depend directly on similar commits...

We just released security updates to Jenkins, versions 2.121 and 2.107.3, that fix multiple security vulnerabilities. Additionally, we announce previously published security issues and corresponding fixes in these plugins: Black Duck Hub Groovy Postbuild Gitlab Hook (fix unreleased) For an overview of what was fixed, see the security advisory. For an overview on the possible impact of these changes on upgrading Jenkins LTS, see our LTS upgrade guide. Subscribe to the...

Anchore provides docker image analysis for user defined acceptance policies to allow automated image validation and acceptance. As developers we would like to know if a change we are proposing introduces a Common Vulnerability and Exposure (CVE). As operators we would like to know what running applications are affected if a new CVE is discovered. Now in Jenkins X pipelines, if we find an Anchore engine service running we...

On behalf of the Jenkins GSoC team and mentors, I would like to welcome Shenyu Zheng, Udara De Silva, Pham Vu Tuan and Abhishek Gautam. They will be working on Google Summer of Code projects in the Jenkins organization, and they have already done some contributions. This year we have the following projects: Code Coverage API Plugin - create a new API Plugin to unify existing Code Coverage plugins and provide new features. Student: Shenyu...

This sort of slid under the radar in the middle of some bigger changes for the JEP-202 reference implementation, so I wanted to call it out now. Arguably this could deserve a retroactive JEP, though I would rather fold it into a JEP for JENKINS-49651 (see below). As of Jenkins 2.118, or plugin parent POM 3.7, you can mark any Java member (class, method, constructor, field, or I suppose also...

Jenkins Essentials has been renamed to Jenkins Evergreen since this was written. A couple weeks ago, I wrote about the Jenkins Essentials effort, on which we’ve been making steady progress. Personally, the most exciting challenge of this project is defining the machinery to drive automatic updates of Jenkins Essentials, which viewed from a high level, are classic continuous delivery challenges. In this post, I wanted to dive into a bit of the...