We’re pleased to announce the formation of the Jenkins Documentation Special Interest Group. The Docs SIG encourages contributors and external communities to create and review Jenkins documentation. See the Special Interest Group Overview for more details and plans. How can I help? The Jenkins Documentation SIG would love to have your help with: reviewing and fixing open bug reports reviewing Jenkins documentation pull requests reviewing Jenkins X documentation pull requests How can...

Since 2017, I started to do some contributions to the Jenkins community. As a beginner, translation might be the easiest way to help the project. You don’t need to understand the whole context, even to create a ticket in the issue tracker system. Improvement of localization usually is minor. But some problems occurred soon, there isn’t a native speaker of Chinese that could review my PRs. So,...

Implementing DevSecOps practices at the enterprise scale is challenging. With multiple programming languages, automated testing frameworks, and security compliance tools being used by different applications within your organization, it becomes difficult to build and maintain pipelines for each team. Most pipelines are going to follow the same generic workflow regardless of which specific tech stack is employed by an application. The Templating Engine Plugin...

Half a year ago we delivered a security fix for Jenkins that had the potential to break the entire Jenkins UI. We needed to change how Jenkins, through the Stapler web framework, handled HTTP requests, tightening the rules around what requests would be processed by Jenkins. In the six months since, we didn’t receive notable reports of problems resulting from this change, and it’s thanks to...

Today we published a security advisory that mostly informs about issues in Jenkins plugins that have no fixes. What’s going on? The Jenkins security team triages incoming reports both to Jira and our non-public mailing list. Once we’ve determined it is a plugin not maintained by any Jenkins security team members, we try to inform the plugin maintainer about the issue, offering our help in developing, reviewing,...

As a software engineer, for many years I have used open source software (frameworks, libraries, tools…​) in the different companies I have worked at. However, I had never been able to engage in an open-source project as a contributor, until now. Since I made my first—​ridiculously simple—​commit into Jenkins, six months ago (in September, 2018), I have been attempting to contribute more to the Jenkins project. However, contributing...

Over the past three months, I have been mentoring two Outreachy interns, David and Latha, with my co-mentor, Jeff Thompson. Our project was to introduce a standardized way for creating an audit log of Jenkins and plugins using Apache Log4j Audit. While this type of feature is addressed by other existing plugins, there is no unifying way for plugins to contribute their own actions. This project provided...

Today Linux Foundation, along with CloudBees, Google, and a number of other companies, launched a new open-source software foundation called Continuous Delivery Foundation (CDF.) The CDF believes in the power of Continuous Delivery, and it aims to foster and sustain the ecosystem of open-source, vendor neutral projects. Jenkins contributors have decided that our project should join this new foundation. This discussion happened over a period...