​

Jenkins

Google Summer of Code 2023

Coding Midterm Demos

​

Jenkins Online Meetup, July 6, 2023

Jenkins Online Meetup

• Community-driven virtual meetups
• Anything about Jenkins: Case studies, success stories, etc.
• Jenkins developer meetups
• https://www.meetup.com/Jenkins-online-meetup
• Looking for speakers!
• https://gitter.im/jenkinsci/advocacy-and-outreach-sig

2

Questions & Answers

• Zoom Chat
• Jenkins GSoC Gitter: https://gitter.im/jenkinsci/gsoc-sig
• After the meetup: Gitter or Discourse https://community.jenkins.io/c/contributing/gsoc/6

​

​

// Code of Conduct:

https://jenkins.io/project/conduct/

3

Agenda

• Introduction to GSoC and Jenkins in GSoC
• Project Demos by GSoC Contributors
• Questions and Answers

​

4

Google Summer Of Code

• Program matching:
• Open Source Orgs & Projects
• Mentors
• GSoC contributors

​

5

https://summerofcode.withgoogle.com/

Jenkins In GSoC 2023

• 2023 - 7th year in GSoC
• 4 project ideas
• Main page: https://www.jenkins.io/projects/gsoc/2023/project-ideas/
• Previous year’s projects:

https://www.jenkins.io/projects/gsoc/

​

​

​

​

6

2023 Jenkins GSoC Contributors

7

Bios: https://www.jenkins.io/node/

Project Presentations

8

by GSoC Contributors

https://www.jenkins.io/projects/gsoc/2023/project-ideas/

Add Probes to "Plugin Health Score"

​

GSoC Contributor:

• Jagruti Tiwari

​

Mentors:

• Adrien Lecharpentier
• Dheeraj Singh Jodha
• Jake Leon
• Antoine Neveux
• Pierre Beitz

​

​

9

Go to Plugin Health Score project page

Agenda

1. What is the plugin health score project?
2. Introduce myself
3. Unreleased production changes probe
4. Third-party repository detection probe
5. Security Scan workflow detection probe
6. What's next?

​

10

What is the Plugin Health Score project?

11

• An automated system ensuring that Jenkins Community defined rules are followed.

​

• A probe collects data about each plugin.

​

• Probe data is used by health scoring to compute a score.

​

• A higher quality probe is given a good score.

​

• An obsolete or outdated plugin is given a lower score.

​

Why I Proposed to Add “Probes” for My GSoC Project

​

• Probes are the heart of the project.

​

• The existing probes are insightful but do not cover all the criterias.

​

• They help to compute accurate

and realistic grade.

​

• Ensures good practices defined

by the community are followed.

​

12

About me

Work

• A senior project engineer with 4.5 yrs experience
• Got promoted 3 months ago
• Responsible for a team at work

Open Source

• Started contributing in 2022
• Was afraid of getting stagnant at work

GSoC

• This project is a right fit. Digging deeper in what I already know.
• Learning leadership skills from my mentors.
• Grateful to the Jenkins community.
• Fortunate to have five active mentors.

​

13

Unreleased Production Changes Probe

Introduction

• Jenkins encourages users to adopt CD.
• Undelivered changes are of no use to users.
• Fixes delivered helps developers to collect feedback.

Importance

• Detects undelivered bug fixes.
• Highlights stale features.
• Inactive maintainer.

Details

• Identify production source code has not been delivered yet.
• Released into production and is currently live at https://plugin-health.jenkins.io/probes

​

​

14

Unreleased Production Changes Probe

Challenges

• Learned JGit API
• Learned Git hierarchy
• Writing Unit test cases
• IntelliJ shortcuts

The fun part

• Had a pair programming session with the mentors

​

15

The Third-Party Repository Detection Probe

Introduction

• Community requested probe
• Maven projects gather dependencies from repository
• Jenkins-infra team was concerned about plugins built from from third-party repositories
• They may cause security and reliability issues.

Probe Details

• Identifies third-party probe in the plugin
• Returns its list

Importance

• Ensures plugins are used from trusted and reliable repositories
• Third-party plugin may break future build, cause licensing issue

​

​

​

16

The Third-Party Repository Detection Probe

Challenges

• Identifying the correct scenarios to test
• Consider parent and child pom relationship from all angles.

Probe status

• After completing 60% of the probe
• Questions arose while writing test cases and code reviews.
• Multiple assumptions made regarding Maven’s project hierarchies
• Plan to build an effective-pom probe at the end of GSoC period.
• On hold until further study to adapt the project’s edge cases and tackle edge cases.

What did I learn?

• Parameterized test cases, pom structure and inheritance, and Maven API

17

GitHub Security Scan Workflow Probe

Introduction

• Digital world is vulnerable to attacks.
• GitHub actions by Jenkins security team automatically scans the source code during CI.
• Considered a good practice in Jenkins to use these tools to ensure security of the plugins.

Probe Details

• Checks security scan configuration in the plugin’s ./github/workflow directory

Importance

• Emphasizes on security of the plugin.
• Checks github workflow configuration to run security scan jobs

​

​

​

​

​

18

GitHub Security Scan Workflow Probe

Challenges

• Taking over an existing contribution.
• Refactoring existing classes to avoid code duplication.

Probe status

• The PR for this probe is underview.

What did I learn?

• Rebase Git branch
• Unit test cases
• How to benefit from class hierarchy

19

What About the Second Half of GSoC?

• Creating probe to:
• Detect renovate usage
• Count open tickets
• Detect plugin-pom version usage
• And more
• Design a scoring system for the completed probes.
• Publish blogs for each of my probes.

​

​

20

What I Want to Learn Next?

• Low level system design
• Like designing classes and methods that implement the OOPs concepts.
• Write integration test cases

21

​

Questions?

22

​

​

23

GitLab Plugin Modernization

Contributor - Harsh Pratap Singh

Mentors - Mark Waite, Basil Crow, Kris Stern, Freyam Mehta

About Me :i

Hi! I am HARSH PRATAP SINGH, an Open Source enthusiast from India.

My interests lie in rapidly evolving Computer Science fields like DevOps and Blockchain, and non technical fields like Economics, Philosophy and many more interesting stuff :)

Currently a Undergrad Freshman at Indian Institute of Technology, Kanpur pursuing Geotechnological Engineering.

Started contributing to Jenkins from February 2023 and got hooked since then.

Check me out! - GitHub and Twitter

​

y

​

​

About the Project

​

What?

The GitLab Plugin enables seamless interaction between

Jenkins and GitLab. This project replaces

the usage of very old RESTEasy library with GitLab4J-API

via GitLab API Jenkins Library Plugin.

​

Why?

1. This migration will greatly reduce future maintenance issues
2. Make the plugin more lightweight due to reduced dependencies
3. Improve consistency with other Jenkins plugins, and
4. Improve documentation.

​

How?

This is what this presentation aims to convey! Lets see :)

Journey Till Now.

​

I was just 2 month old to programming when i started peeking into the Jenkins community and I think it helped me a lot gaining practical experience in Software Engineering.

​

What I learned? Quite a lot

1. Git, GitHub, and most importantly GitLab
2. Extensive Debugging (even inside Docker containers)
3. Stronger grasp on core programming concepts of JAVA
4. Maven, SpotBugs and other JAVA build toolings
5. Functional Testing using JUnit5 and Mockito and Docker-based testing

​

Progress till now :

1. Completed migration from RESTEasy to GitLab4J-API via GitLab-API plugin
2. Interactively tested the migrated Plugin

​

What Has Changed?

​

Migration should be like MAGIC, in which the end-user doesn’t

even feel that something inside has changed. Ideally! But…

​

Over the years GitLab has evolved, thus

during the migration we found out that the plugin will have

Removal of GitLab API V3 support soon as GitLab has dropped V3

and only supports V4 of its API currently.

Thus, we encourage V3 users to switch to V4 as soon as possible.

​

​

Minimum GitLab version - 14.0

Minimum Jenkins version - 2.387.3

Demo

Let’s see if it works LIVE or not!!

​

​

Journey Ahead…..

​

Following things have to be done during the 2nd Phase :

1. Adapting Webhooks to GitLab4J-API’s events (WIP)
2. Migrating Proxy settings
3. Adapting Tests (WIP)
4. Improving documentation
5. Extensive Testing, Testing, and Testing….

​

References

​

Learn more about the project - Project Page

​

Join us for project discussions - Gitter Channel

​

Project meetings - Notes and Recordings

​

See code, file an issue or request - GitHub Repository Link

THANK YOU!

especially to my lovely mentors,

the supportive community,

and for your patient listening

​

Questions?

​

Building Jenkins.io with Alternative Tools

GSoC Contributor: Vandit Singh

Mentors: Mark Waite, Kris Stern,

Yiming Gong, Rajiv Singh

table of contents

Project Description

01.

04.

02.

05.

03.

Milestones Achieved

What was planned

Demo

Questions

1. Project Description

My project aims to build the currently hosted jenkins.io site with Antora and Gatsby because Awestruct which we use currently for site generation has been under maintained since last 2 year.

Why Antora?

Antora provides versioning for documentation. Due to which we will be providing versioned documentation to Jenkins users. It means the users can look up for documentation of the Jenkins LTS version they are using.

​

Why Gatsby?

Gatsby is famous for its fast builds, secure, and powerful websites using a React-based framework rest of the site will be made using Gatsby.

03.

What was Planned

What

was

Planned

It was planned to generate the entire site with Antora

Antora

Gatsby

Gatsby will be used to generate blogs section only

YAML Files

YAML files that are used to generate pages like changelogs etc. will be generated via Gatsby

Changes

Changes are after community feedback : Link to the discussion

Issues We Faced

04.

Demo Site via GitHub pages

Because personally I won’t believe anyone without any actual proof ; )

05.

Future Plans

Future

Plans

i. Complete the rest of the work in the

documentation site i.e fix interpage linking

​

ii. Solutions page layout

​

iii. Start working on blogs and site pages for security, advisories, changelogs, download.

​

​

06.

Questions

Interested in the project?

Gitter

Github

Repositories

Meeting

Notes

Project

Plan

This is where we talk about how things are progressing

We have two repositories that are crucial for the project

• jenkins-docs
• jenkins-ui-project

This is where we keep a track of everything on a weekly basis

Project Plan is hosted on github wiki

Thank You!

Docker-Based Jenkins

Quick Start Examples

​

GSoC Contributor :

• Ashutosh Saxena

​

Mentors :

• Bruno Verachten
• Bervianto Leo Pratama
• Jean-Marc Meessen

​

​

What’s the Problem?

01

Let Me Paint a Picture

Let’s see what users first experience of Jenkins looks like: -

​

• docker network create jenkins

​

• docker run --name jenkins-docker --rm --detach --privileged --network jenkins --network-alias docker --env DOCKER_TLS_CERTDIR=/certs --volume jenkins-docker-certs:/certs/client --volume jenkins-data:/var/jenkins_home --publish 2376:2376 docker:dind

• docker build -t myjenkins-blueocean:1.1 .

​

• docker run --name jenkins-blueocean --rm --detach --network jenkins --env DOCKER_HOST=tcp://docker:2376 --env DOCKER_CERT_PATH=/certs/client --env DOCKER_TLS_VERIFY=1 --publish 8080:8080 --publish 50000:50000 --volume jenkins-data:/var/jenkins_home --volume jenkins-docker-certs:/certs/client:ro myjenkins-blueocean:1.1

• Security risks
• Intimidating steps
• Tutorials

Problems?

02

How are We Solving This?

• Docker compose hides complexity

​

• Script automate the running of the jenkins container with docker

​

• ./jenkins_init.sh

​

• Another script cleans everything

​

• ./jenkins_teardown.sh

Intimidating Steps

• Controller and agent are separate containers

​

• Another script ./keygen.sh that creates and updates ssh keys

​

• docker-compose files are configured with new ssh keys every time ./jenkins_init.sh is ran

Security Risk of Running jobs on Controller

• The target audience of these tutorials are beginners who are here to learn about Jenkins, not about how difficult Docker is.

• Let's observe how a beginner will perform the "Build a Java App with Maven" tutorial after this project.

​

• He/She will use ./jenkins_init.sh maven

​

What About Other Tutorials?

That’s It

• The containers are running with custom Jenkins agent image made for running Maven tutorial
• Jenkins can be accessed on http://localhost:8080

And yes, everything works with Gitpod, with just a click!

Demo Time!!

What I Learned?

​

• Git, Github best practices
• Resolve merge conflicts!! (not perfect yet)
• A lot about the Jenkins file system
• Writing docker-compose files
• Writing Shell Scripts
• Writing Dockerfiles
• How ssh-keys works
• How gitpod works
• How to write technical documentation

What’s Next?

Adding more Tutorials

Adding more tutorials and integrating them with ./jenkins_init.sh

Testing with GitHub Actions & ci.jenkins.io

All the tutorial files and scripts will be tested regularly

Developing concise and easy to understand documentation for new and updated tutorials

Documentation

Windows Support

Adding support for windows without WSL

​

​

Questions?

Thank you

For listening. You can find more info about the project here�You can follow project’s progress on gitter and github

More Resources

• Jenkins GSoC website
• https://jenkins.io/projects/gsoc
• GSoC Office Hours meeting notes and recordings:
• https://docs.google.com/document/d/1UykfAHpPYtSx-r_PQIRikz2QUrX1SG-ySriz20rVmE0/edit?usp=sharing
• Blog:
• https://jenkins.io/node/tags/gsoc/
• GSoC Discourse
• https://community.jenkins.io/c/contributing/gsoc/6
• Office hours recordings: https://community.jenkins.io/t/jenkins-gsoc-2022-office-hours/1392/3

​

​

65

Jenkins Upcoming Events

66

Thank You!

67