-
Notifications
You must be signed in to change notification settings - Fork 1
chore(jenkins): Updates Jenkins plugins #287
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Conversation
Bumps debian from bookworm-20231218 to bookworm-20240110. --- updated-dependencies: - dependency-name: debian dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
…dekick/debian-bookworm-20240110 chore(deps): bump debian from bookworm-20231218 to bookworm-20240110 in /dockerfiles/sidekick
chore(jenkins): Updates Jenkins plugins
Bumps [updatecli/updatecli-action](https://github.com/updatecli/updatecli-action) from 2.52.0 to 2.53.0. - [Release notes](https://github.com/updatecli/updatecli-action/releases) - [Commits](updatecli/updatecli-action@v2.52.0...v2.53.0) --- updated-dependencies: - dependency-name: updatecli/updatecli-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 3.5.0 to 3.6.0. - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/CHANGELOG.md) - [Commits](anchore/scan-action@1d59d90...0550541) --- updated-dependencies: - dependency-name: anchore/scan-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
chore(jenkins): Updates Jenkins plugins
chore(jenkins): Updates Jenkins plugins
…cli/updatecli-action-2.53.0 chore(deps): bump updatecli/updatecli-action from 2.52.0 to 2.53.0
…e/scan-action-3.6.0 chore(deps): bump anchore/scan-action from 3.5.0 to 3.6.0
Bumps [updatecli/updatecli-action](https://github.com/updatecli/updatecli-action) from 2.53.0 to 2.54.0. - [Release notes](https://github.com/updatecli/updatecli-action/releases) - [Commits](updatecli/updatecli-action@v2.53.0...v2.54.0) --- updated-dependencies: - dependency-name: updatecli/updatecli-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps debian from bookworm-20240110 to bookworm-20240130. --- updated-dependencies: - dependency-name: debian dependency-type: direct:production ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps jenkins/ssh-agent from 5.22.0 to 5.24.0. --- updated-dependencies: - dependency-name: jenkins/ssh-agent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps jenkins/ssh-agent from 5.22.0 to 5.24.0. --- updated-dependencies: - dependency-name: jenkins/ssh-agent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps jenkins/ssh-agent from 5.22.0 to 5.24.0. --- updated-dependencies: - dependency-name: jenkins/ssh-agent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [release-drafter/release-drafter](https://github.com/release-drafter/release-drafter) from 5 to 6. - [Release notes](https://github.com/release-drafter/release-drafter/releases) - [Commits](release-drafter/release-drafter@v5...v6) --- updated-dependencies: - dependency-name: release-drafter/release-drafter dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 3.6.0 to 3.6.4. - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/CHANGELOG.md) - [Commits](anchore/scan-action@0550541...3343887) --- updated-dependencies: - dependency-name: anchore/scan-action dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps jenkins/ssh-agent from 5.22.0 to 5.24.0. --- updated-dependencies: - dependency-name: jenkins/ssh-agent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps jenkins/ssh-agent from 5.22.0 to 5.24.0. --- updated-dependencies: - dependency-name: jenkins/ssh-agent dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
Bumps [codacy/codacy-analysis-cli-action](https://github.com/codacy/codacy-analysis-cli-action) from 4.3.0 to 4.4.0. - [Release notes](https://github.com/codacy/codacy-analysis-cli-action/releases) - [Commits](codacy/codacy-analysis-cli-action@5cc54a7...33d4559) --- updated-dependencies: - dependency-name: codacy/codacy-analysis-cli-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
…cli/updatecli-action-2.54.0 chore(deps): bump updatecli/updatecli-action from 2.53.0 to 2.54.0
…dekick/debian-bookworm-20240130 chore(deps): bump debian from bookworm-20240110 to bookworm-20240130 in /dockerfiles/sidekick
…thon/jenkins/ssh-agent-5.24.0 chore(deps): bump jenkins/ssh-agent from 5.22.0 to 5.24.0 in /dockerfiles/python
…ven/jenkins/ssh-agent-5.24.0 chore(deps): bump jenkins/ssh-agent from 5.22.0 to 5.24.0 in /dockerfiles/maven
…e-drafter/release-drafter-6 chore(deps): bump release-drafter/release-drafter from 5 to 6
…e/scan-action-3.6.4 chore(deps): bump anchore/scan-action from 3.6.0 to 3.6.4
…lti/jenkins/ssh-agent-5.24.0 chore(deps): bump jenkins/ssh-agent from 5.22.0 to 5.24.0 in /dockerfiles/multi
…achable. And making the timeout duration configurable.
Bumps [anchore/scan-action](https://github.com/anchore/scan-action) from 5.2.1 to 5.3.0. - [Release notes](https://github.com/anchore/scan-action/releases) - [Changelog](https://github.com/anchore/scan-action/blob/main/CHANGELOG.md) - [Commits](anchore/scan-action@f2ba85e...869c549) --- updated-dependencies: - dependency-name: anchore/scan-action dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <[email protected]>
…re/scan-action-5.3.0 chore(deps): bump anchore/scan-action from 5.2.1 to 5.3.0
chore(jenkins): Updates Jenkins plugins
fix(docker): Multi does not launch a second Jenkins controller anymore.
chore(jenkins): Updates Jenkins plugins
chore(jenkins): Updates Jenkins plugins
chore(jenkins): Updates Jenkins plugins
chore(jenkins): Updates Jenkins plugins
chore(jenkins): Updates Jenkins plugins
WalkthroughThe changes involve updating the version numbers of several plugins in the Changes
Possibly related PRs
Suggested labels
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🧰 Additional context used🪛 Gitleaks (8.21.2)dockerfiles/plugins.txt12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 14-14: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 🔇 Additional comments (3)dockerfiles/plugins.txt (3)Line range hint The plugin version formats follow Jenkins conventions:
🧰 Tools🪛 Gitleaks (8.21.2)8-8: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 14-14: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key)
The following security-sensitive plugins are being updated:
Also applies to: 61-61, 42-42 ✅ Verification successfulLet me analyze the changelog information we received:
Let me fetch the GitHub releases information: Based on the information gathered, I can now provide a final response about these security-sensitive plugin updates: Security-critical plugin updates appear safe to proceed The updates for these security-sensitive plugins contain:
All changes appear to be routine maintenance updates rather than security fixes. The updates focus on improvements, dependency updates, and technical debt reduction. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Verify changelog and security fixes for security-critical plugins
for plugin in "credentials" "script-security" "matrix-auth"; do
echo "Checking $plugin changelog..."
curl -s "https://raw.githubusercontent.com/jenkinsci/$plugin-plugin/master/CHANGELOG.md" || \
curl -s "https://raw.githubusercontent.com/jenkinsci/$plugin-plugin/main/CHANGELOG.md"
done
Length of output: 40331 Script: #!/bin/bash
# Get latest GitHub releases for the plugins
for plugin in "credentials" "script-security" "matrix-auth"; do
echo "Checking $plugin releases..."
gh api repos/jenkinsci/$plugin-plugin/releases/latest --jq '.tag_name + " - " + .published_at + "\n" + .body'
done
Length of output: 1791 Line range hint The plugin updates appear to be routine maintenance. However, it's important to verify:
Consider implementing automated plugin update verification in your CI pipeline to:
✅ Verification successfulLet me try a different approach to verify the plugins and their compatibility. Based on the gathered information, I can now provide a final response: Plugin updates are compatible with Jenkins LTS 2.479.2 The plugins list has been verified against the Jenkins controller version (2.479.2) specified in the Dockerfile. The updates include:
The plugin versions follow Jenkins' versioning scheme and are from the official update center, indicating they've passed compatibility tests. 🏁 Scripts executedThe following scripts were executed for the analysis: Script: #!/bin/bash
# Description: Analyze plugin updates for compatibility and security concerns
# Extract plugin names and versions
echo "Analyzing plugin versions and dependencies..."
cat dockerfiles/plugins.txt | while read line; do
plugin_name=$(echo $line | cut -d: -f1)
version=$(echo $line | cut -d: -f2)
# Query Jenkins update center API for plugin info
curl -s "https://updates.jenkins.io/current/plugin-versions.json" | \
jq --arg name "$plugin_name" --arg version "$version" \
'.plugins[$name] | select(.version == $version) | {
version: .version,
requiredCore: .requiredCore,
dependencies: .dependencies,
securityWarnings: .securityWarnings
}'
done
# Check for any known security advisories
echo "Checking for security advisories..."
gh api graphql -f query='
{
securityVulnerabilities(first: 10, ecosystem: MAVEN, package: "org.jenkins-ci.plugins") {
nodes {
advisory {
summary
severity
publishedAt
}
vulnerableVersionRange
firstPatchedVersion {
identifier
}
}
}
}'
Length of output: 46870 Script: #!/bin/bash
# Let's check for a Jenkins version file and plugin compatibility info
# Check if there's a Jenkins version specified in the repo
echo "Looking for Jenkins version specification..."
fd -t f "jenkins|Dockerfile" | xargs grep -l "jenkins" | xargs cat
# Get the plugins.txt content for analysis
echo -e "\nAnalyzing plugins.txt..."
cat dockerfiles/plugins.txt
# Look for any plugin-related configuration files
echo -e "\nLooking for plugin configurations..."
fd -t f "jenkins|plugin" | grep -i "config\|plugin"
Length of output: 23167 🧰 Tools🪛 Gitleaks (8.21.2)8-8: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 12-12: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) 14-14: Detected a Generic API Key, potentially exposing access to various services and sensitive operations. (generic-api-key) Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
| # Check if the service has dependencies | ||
| if yq e ".services.${service}.depends_on" "$original_file" -e > /dev/null; then | ||
| # Read dependencies of the service | ||
| local dependencies=($(yq e ".services.${service}.depends_on | keys" "$original_file" -o json | jq -r '.[]')) |
Check notice
Code scanning / Shellcheck (reported by Codacy)
Prefer mapfile or read -a to split command output (or quote to avoid splitting). Note
| declare -A all_dependencies | ||
| services=$(yq e '.services | keys' "$original_file" -o json | jq -r '.[]') | ||
| for service in $services; do | ||
| dependencies=$(yq e ".services.$service.depends_on | keys" "$original_file" -o json | jq -r '.[]') |
Check notice
Code scanning / Shellcheck (reported by Codacy)
Variable was used as an array but is now assigned a string. Note
| services=$(yq e '.services | keys' "$original_file" -o json | jq -r '.[]') | ||
| for service in $services; do | ||
| dependencies=$(yq e ".services.$service.depends_on | keys" "$original_file" -o json | jq -r '.[]') | ||
| for dependency in $dependencies; do |
Check notice
Code scanning / Shellcheck (reported by Codacy)
Expanding an array without an index only gives the first element. Note
| for service in $services; do | ||
| dependencies=$(yq e ".services.$service.depends_on | keys" "$original_file" -o json | jq -r '.[]') | ||
| for dependency in $dependencies; do | ||
| all_dependencies["$dependency"]=1 |
Check notice
Code scanning / Shellcheck (reported by Codacy)
all_dependencies appears unused. Verify use (or export if used externally). Note
|
|
||
| # Generate the docker-compose file for the profile | ||
| echo "Generating docker-compose-$profile.yaml" | ||
| yq e ".services | with_entries(select(.key as \$k | .key == \"$included_services_list\"))" "$original_file" > "docker-compose-$profile.yaml" |
Check warning
Code scanning / Shellcheck (reported by Codacy)
included_services_list is referenced but not assigned. Warning
This pull request updates the Jenkins plugins listed in
plugins.txt.Summary by CodeRabbit
cloudbees-folderandcredentials.