Quality Gates and Promotion

Scenario: A scanner publishes a dashboard, but deployment starts without checking its result against policy.

Pipeline example

stage('Gate') { steps { timeout(time: 10, unit: 'MINUTES') { sh './quality-gate.sh' } } }

Publishing analysis does not enforce it

A scanner may upload results and return before server processing finishes. A dashboard link proves analysis exists, not that policy passed. A gate stage must wait or poll for the task created by this build, translate its status into Jenkins result semantics, and use a timeout. Distinguish policy rejection from scanner outage, malformed response, and authentication failure.

Govern thresholds such as new critical vulnerabilities, changed-code coverage, licenses, or provenance. Record scanner and ruleset versions, project key, revision, artifact digest, and result URL. Do not let every repository silently disable mandatory policy, but support explicit, audited evolution of thresholds.

Gate the object that will ship

If scanning digest A and deploying mutable tag latest resolves digest B, the check is irrelevant. Promotion consumes the exact analyzed digest and associated evidence. Overrides record approver, reason, expiry, affected artifact, and compensating work; editing a Jenkinsfile to ignore an exit code is not a waiver.

On failure preserve reports and route ownership. On service outage choose fail-closed, stop delivery, or invoke a documented time-limited exception. Shell parsing accidents and default success must never choose security policy implicitly.

Goal: Practice the concrete behavior in jenkins-artifact-promotion. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.