{"product_id":"jenkins-pipeline-as-code-templates","title":"Jenkins Pipeline as Code Templates","description":"\u003ch3\u003eJenkins Pipeline as Code Templates\u003c\/h3\u003e\n\u003cp\u003eJenkins is the tool everyone has opinions about but nobody wants to maintain. I have inherited Jenkins instances at three different enterprises where the Jenkinsfile was a 2,000-line scripted pipeline written by an engineer who left two years ago. No shared libraries, no parameterized stages, and plugins that had not been updated since 2021. When I rebuilt the Jenkins pipeline for a defense contractor's classified build system, the goal was simple: make it so reliable that the platform team does not get paged about CI anymore. This template achieves that.\u003c\/p\u003e\n\n\u003cp\u003eThis declarative Jenkinsfile uses shared libraries, parallel stages, and environment-specific deployment gates. It runs on Jenkins 2.440+ with the Pipeline, Docker, and Credentials plugins.\u003c\/p\u003e\n\n\u003ch3\u003ePipeline Stages\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eCheckout\u003c\/strong\u003e — \u003ccode\u003echeckout scm\u003c\/code\u003e with \u003ccode\u003eCleanCheckout\u003c\/code\u003e extension. Ensures a pristine workspace on every build. Shallow clone with \u003ccode\u003edepth: 1\u003c\/code\u003e for faster checkout on large repositories.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBuild\u003c\/strong\u003e — Runs inside a Docker agent (\u003ccode\u003eagent { docker { image 'node:20-alpine' } }\u003c\/code\u003e) for reproducible builds. \u003ccode\u003estash\u003c\/code\u003e captures build artifacts for downstream stages.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTest\u003c\/strong\u003e — \u003ccode\u003eparallel\u003c\/code\u003e block runs unit, integration, and contract tests simultaneously. \u003ccode\u003ejunit '**\/test-results\/*.xml'\u003c\/code\u003e publishes results to the Jenkins test dashboard. Coverage via Cobertura plugin.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eSecurity Scan\u003c\/strong\u003e — SonarQube analysis via \u003ccode\u003ewithSonarQubeEnv('sonar')\u003c\/code\u003e plus \u003ccode\u003ewaitForQualityGate\u003c\/code\u003e. Trivy container scan. OWASP Dependency-Check for vulnerable libraries.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eBuild Image\u003c\/strong\u003e — \u003ccode\u003edocker.build(\"app:${env.BUILD_NUMBER}\")\u003c\/code\u003e with multi-stage Dockerfile. Push to private registry with both build number and git SHA tags.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDeploy Dev\u003c\/strong\u003e — Automatic on \u003ccode\u003edevelop\u003c\/code\u003e branch. Uses Jenkins credentials store for deployment keys. \u003ccode\u003esshagent\u003c\/code\u003e for remote deployment or \u003ccode\u003ewithKubeConfig\u003c\/code\u003e for Kubernetes.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDeploy Staging\u003c\/strong\u003e — \u003ccode\u003einput message: 'Deploy to staging?'\u003c\/code\u003e manual gate. Timeout after 24 hours. Runs smoke tests post-deployment.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDeploy Prod\u003c\/strong\u003e — \u003ccode\u003einput\u003c\/code\u003e gate with \u003ccode\u003esubmitter: 'prod-approvers'\u003c\/code\u003e. Blue-green deployment via load balancer switch. Health check validation before traffic cutover. Automatic rollback on health check failure.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eSecurity Gates\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eSonarQube Quality Gate\u003c\/strong\u003e — Blocks pipeline if code quality metrics drop below threshold: coverage, duplications, security hotspots, reliability rating.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eOWASP Dependency-Check\u003c\/strong\u003e — Scans project dependencies against NVD. Fails on CVSS score \u0026gt;= 7.0.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eCredentials management\u003c\/strong\u003e — All secrets stored in Jenkins Credentials store with \u003ccode\u003ewithCredentials\u003c\/code\u003e binding. No plaintext secrets in Jenkinsfile or job configuration.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eTrivy container scan\u003c\/strong\u003e — Post-build image scan. Critical vulnerabilities block the deployment stage.\u003c\/li\u003e\n\u003c\/ul\u003e\n\n\u003ch3\u003eWhat Breaks First\u003c\/h3\u003e\n\u003cul\u003e\n\u003cli\u003e\n\u003cstrong\u003eAgent workspace disk exhaustion\u003c\/strong\u003e — Jenkins agents accumulate workspaces from old builds. Fix: configure \"Discard Old Builds\" to keep last 10 builds and add \u003ccode\u003ecleanWs()\u003c\/code\u003e in \u003ccode\u003epost { always }\u003c\/code\u003e block.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003ePlugin version conflicts after update\u003c\/strong\u003e — Updating the Pipeline plugin breaks syntax that worked on the previous version. Fix: pin plugin versions in \u003ccode\u003eplugins.txt\u003c\/code\u003e, test updates on a staging Jenkins instance first.\u003c\/li\u003e\n\u003cli\u003e\n\u003cstrong\u003eDocker-in-Docker socket permission errors\u003c\/strong\u003e — Running Docker commands inside a Docker agent requires the socket mount. Fix: use \u003ccode\u003e-v \/var\/run\/docker.sock:\/var\/run\/docker.sock\u003c\/code\u003e in the agent args, or use Kaniko for rootless builds.\u003c\/li\u003e\n\u003c\/ul\u003e","brand":"Citadel Cloud Management","offers":[{"title":"Default Title","offer_id":54890411163939,"sku":"CCM-DEV-006","price":39.0,"currency_code":"USD","in_stock":true}],"thumbnail_url":"\/\/cdn.shopify.com\/s\/files\/1\/0979\/8539\/7027\/files\/citadel-devops-product_0ff2bcd2-a708-4b6f-8163-fc258c8f84fb.png?v=1775138130","url":"https:\/\/citadel-cloud-management.myshopify.com\/products\/jenkins-pipeline-as-code-templates","provider":"Citadel Cloud Management","version":"1.0","type":"link"}