7

Our build job on Jenkins runs as part of a release build some git commands like git push and git pull, therefore requires a way to run authenticated git commands from the shell during the build.

Our jenkins slaves don't hold any credentials as they are disposable docker containers that are created per build.

The git plugin manages this with the Jenkins credentials and "somehow" sets GIT_SSH to pick up a private key that is configured via the credentials.

I checked the source code and tried to determine how I can get the variable configured so that I can run for example git pull as an SSH script as part of the build. Without success.

Is there a way to run a git command as part of the build steps using the Jenkins credentials?

My current solution is to copy the SSH key to the slave as part of the build environment setup but seems like duplicate work (plus potential security issue).

Mark O'Connor
  • 72,448
  • 10
  • 129
  • 174
Elmar Weber
  • 2,393
  • 24
  • 24

2 Answers2

2

I couldn't figure this out for a while too. So although almost three years old I'll post my solution for using a private SSH Key. It may also be adaptable user/password combinations.

  1. Add the key to the credentials section as kind "SSH Username with private key".

  2. In the build project use the "Bindings" (You need to tick the "Use secret text(s) or file(s)" in the Build Environment to make it available) to store the credential information in environment variables:

    enter image description here

  3. Now comes the tricky part on how to use the key in the git call. I chose GIT_SSH environment variable since the is the most backward compatible way. In order to make that work you need to create a wrapper script that contains the ssh call using the path to the key file provided in SSH_KEYFILE. One may find a better solution to create that script. For me the following shell commands worked:

    #!/bin/bash
set +x

SSH_WRAPPER_SCRIPT=/tmp/ssh_wrapper

# delete pre-existing script
[[ -f $SSH_WRAPPER_SCRIPT ]] && rm $SSH_WRAPPER_SCRIPT

# create wrapper script with current keyfile path from bindings variable
echo "#!/bin/sh" >> $SSH_WRAPPER_SCRIPT
echo "exec /usr/bin/ssh -i ${SSH_KEYFILE} \"\$@\"" >> $SSH_WRAPPER_SCRIPT
chmod +x $SSH_WRAPPER_SCRIPT

# set GIT_SSH env var to use wrapper script
export GIT_SSH=$SSH_WRAPPER_SCRIPT

# now run your actual git commands here
git ls-remote -h git@someserver.com:some_repo.git HEAD
cweigel
  • 1,159
  • 13
  • 18
  • 1
    Unfortunately, the image in the answer above is no longer available. So I'll quickly summarize its content here: (1) Install the "Credentials Binding Plugin" (2) Then, the project configuration contains "Build Environment - Use secret text(s) or file(s)" (3) With the latest version as of Jan 2020, select "SSH User Private Key" binding and enter "SSH_KEYFILE" as "Key File Variable". Then the above solution will work. – leosh Jan 09 '20 at 09:21
  • I sill can see the image and open the link in a separate browser without issue. As of January 2020 it still works fine. – cweigel Jan 09 '20 at 16:26
  • Oh, then it must be a problem with my proxy configuration or internet connection. – leosh Jan 10 '20 at 02:34
-2

If running sharing credentials via git is essential, give the git client plugin a try but if you really want to just share/store credentials, consider using credentials plugin or something similar.

Note that you can also just run a shell script "after install" that can run whatever commands you need to execute on the machine.

blr
  • 668
  • 3
  • 7
  • I don't think I get it, the plugins will not help for the issue mentioned. The shell script is what I am doing at the moment with the copy (well, not a shell script but a build environment step). – Elmar Weber Sep 24 '16 at 15:11