Options, Environment, and Tools

Scenario: A job silently changes after a globally configured latest tool is upgraded.

Pipeline example

pipeline { agent any; options { timeout(time: 20, unit: 'MINUTES'); timestamps() }; environment { TARGET = 'staging' }; stages { stage('Verify') { steps { sh './verify.sh' } } } }

Scope policy deliberately

Top-level options can bound a run with timeout, timestamps, buildDiscarder, disableConcurrentBuilds, skipDefaultCheckout, or disableResume. Stage options apply more narrowly and may include time spent allocating that stage's agent. A ten-minute test budget should not accidentally include a forty-minute human approval, while an overall deadline prevents abandoned runs from surviving indefinitely. Place each constraint where its operational meaning is clear.

Environment directives create string values globally or per stage, with narrower scopes overriding broader names. Validate required values early because environment variables are not a typed configuration system. Credential helpers create bound values and related variables; never use Groovy interpolation to place them in command arguments. Single-quoted Groovy shell strings let the shell expand a variable without exposing its value during Pipeline interpolation.

Remove invisible tool drift

The tools directive requests a named controller-managed installation and adjusts PATH. If an administrator repoints node-latest, unchanged repositories can produce different results. Use documented versioned names, wrappers, or immutable agent images, and print non-secret provenance: Java, Node, build tool, scanner, image digest, source revision, selected label, and parameters.

Test policy rather than assuming it: let timeout expire, launch concurrent builds, restart with resume disabled, and verify retention removes only intended history. Stage-level environment overrides should appear in review and logs without disclosing secrets. Reproducibility means a future investigator can identify the resolved tools and inputs, not merely see that a symbolic global name was requested.

Goal: Practice the concrete behavior in jenkins-declarative-rescue. Learn sections have no Jenkins terminal; the Jenkins lab opens the real shared service in a new full-screen tab inside your private folder.