Two months ago I published an introductory article on the journey of becoming a Jenkins contributor. In that first article, the jenkins.io site was reviewed, learning about the multiple ways in which we can participate and contribute. Then, a first—​basic—​contribution I made to the site repository was described. Now, in this new article we will be exploring more advanced contributions, committing code to the actual Jenkins core. Getting started...

The Audit Log Plugin for Jenkins is an in development project to integrate standardized audit logging trails to various core actions in Jenkins. This project integrates the recently released Apache Log4j Audit library to allow for a vast array of possible audit logging destinations and configuration. We began this plugin not long after Log4j Audit 1.0.0 was released last year by partnering with Outreachy where we...

We’re pleased to announce the formation of the Jenkins Documentation Special Interest Group. The Docs SIG encourages contributors and external communities to create and review Jenkins documentation. See the Special Interest Group Overview for more details and plans. How can I help? The Jenkins Documentation SIG would love to have your help with: reviewing and fixing open bug reports reviewing Jenkins documentation pull requests reviewing Jenkins X documentation pull requests How can...

Implementing DevSecOps practices at the enterprise scale is challenging. With multiple programming languages, automated testing frameworks, and security compliance tools being used by different applications within your organization, it becomes difficult to build and maintain pipelines for each team. Most pipelines are going to follow the same generic workflow regardless of which specific tech stack is employed by an application. The Templating Engine Plugin...

Since 2017, I started to do some contributions to the Jenkins community. As a beginner, translation might be the easiest way to help the project. You don’t need to understand the whole context, even to create a ticket in the issue tracker system. Improvement of localization usually is minor. But some problems occurred soon, there isn’t a native speaker of Chinese that could review my PRs. So,...

Half a year ago we delivered a security fix for Jenkins that had the potential to break the entire Jenkins UI. We needed to change how Jenkins, through the Stapler web framework, handled HTTP requests, tightening the rules around what requests would be processed by Jenkins. In the six months since, we didn’t receive notable reports of problems resulting from this change, and it’s thanks to...

Today we published a security advisory that mostly informs about issues in Jenkins plugins that have no fixes. What’s going on? The Jenkins security team triages incoming reports both to Jira and our non-public mailing list. Once we’ve determined it is a plugin not maintained by any Jenkins security team members, we try to inform the plugin maintainer about the issue, offering our help in developing, reviewing,...

As a software engineer, for many years I have used open source software (frameworks, libraries, tools…​) in the different companies I have worked at. However, I had never been able to engage in an open-source project as a contributor, until now. Since I made my first—​ridiculously simple—​commit into Jenkins, six months ago (in September, 2018), I have been attempting to contribute more to the Jenkins project. However, contributing...