[JIRA] (JENKINS-40480) Do not run a Multibranch Pipeline job if Jenkinsfile is updated by unauthorized people

[greaumax...@gmail.com (JIRA)]

Title: Message Title

Maxime GREAU created an issue   Jenkins / JENKINS-40480 Do not run a Multibranch Pipeline job if Jenkinsfile is updated by unauthorized people Issue Type: Improvement Assignee: Unassigned Components: pipeline, security, workflow-multibranch-plugin Created: 2016/Dec/15 3:32 PM Labels: pipeline jenkinsfile multibranch security Priority: Minor Reporter: Maxime GREAU Context We have more than 300 Pipeline jobs to run Maven builds (CI, Sonar...) into Docker containers for 50+ GitHub projects. All those pipeline jobs are generated, thanks to the Job DSL plugin: pipelineJob(){ ... definition { cps { script('''#!groovy node('ci-docker'){ exoCI{} } ''' + "${upstreamJob}") } } } It's ok for some CI & Sonar jobs (develop/master/stable branches) but not useful to automatically build PRs and so on. Why do we not use Jenkinsfiles on our GitHub projects? We do not use the Jenkinsfile on our git projects for now because we can't control "who is able to do what" on those specific files. Indeed, even we can manage people who have write access to our GitHub repositories, we do not consider those Jenkinsfiles like others Java, XML... code source files. We applied the recommended practices by disabling executors on the master and by having CI servers agents with "only" Docker & Git installed, but despite this we don't want that "unauthorized people" can execute whatever commands on those servers by using the Jenkinsfile. Proposition My proposition to fix this problem is to manage a whitelisted users (and whitelisted organisation for GitHub) to identify which people are able to execute a build with an updated Jenkinsfile in the SCM. if the Jenkinsfile is the same as the default branch -> execute the build if the Jenkinsfile has been updated by people in the whitelisted users -> execute the build otherwise do not execute the build WDYT? Add Comment   This message was sent by Atlassian JIRA (v7.1.7#71011-sha1:2526d7c) -- You received this message because you are subscribed to the Google Groups "Jenkins Issues" group. To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-issues+unsubscr...@googlegroups.com. For more options, visit https://groups.google.com/d/optout.