为什么詹金斯管道无法访问某些秘密答案

【问题标题】：why the jenkins pipeline could not access some secret为什么詹金斯管道无法访问某些秘密
【发布时间】：2020-12-11 13:08:22
【问题描述】：

我在 jenkins 中定义了一些秘密凭证，现在我在 jenkins 管道中使用它，如下所示：

pipeline {
    
    agent { 
        node {
            label 'jenkins-master'
        }
    }

    environment {
        GITHUB_USERNAME     = credentials('github-username')
        GITHUB_PASSWORD     = credentials('github-password')
        GITHUB_PASSWORD1    = credentials('github-password-1')
        df    = credentials('123')
    }

    stages {
        stage('checkout-source') {
            steps {
                git credentialsId: 'gitlab-project-auth',
                url: 'https://github.com/jiangxiaoqiang/jiangxiaoqiang.github.io.git'
             } 
        }
        
       stage('publish') {
            steps{
                sh "git config --global user.email \"jiangtingqiang@gmail.com\""
                sh "git config --global user.name \"jiangxiaoqiang\""
                sh "git add -A"
                sh "git diff-index --quiet HEAD || git commit -m \"[docs] scheduled auto commit task\" || git push"
                sh "echo ${GITHUB_USERNAME}"
                sh "echo ${GITHUB_PASSWORD}"
                sh "echo ${GITHUB_PASSWORD1}"
                sh "echo ${df}"
                sh "git push https://${GITHUB_USERNAME}:${GITHUB_PASSWORD}@github.com/jiangxiaoqiang/jiangxiaoqiang.github.io.git"
            }
        }
    }
}

但似乎只有第一个作品，这是构建日志输出：

 > git rev-parse --is-inside-work-tree # timeout=10
Fetching changes from the remote Git repository
 > git config remote.origin.url https://github.com/****/xiaoqiang-blog-source.git # timeout=10
Fetching upstream changes from https://github.com/****/xiaoqiang-blog-source.git
 > git --version # timeout=10
 > git --version # 'git version 2.11.0'
 > git fetch --tags --progress -- https://github.com/****/xiaoqiang-blog-source.git +refs/heads/*:refs/remotes/origin/* # timeout=10
 > git rev-parse refs/remotes/origin/master^{commit} # timeout=10
 > git rev-parse refs/remotes/origin/origin/master^{commit} # timeout=10
Checking out Revision d24abcbc136a3f050b9c1aa365bf30dcc6b77bb9 (refs/remotes/origin/master)
 > git config core.sparsecheckout # timeout=10
 > git checkout -f d24abcbc136a3f050b9c1aa365bf30dcc6b77bb9 # timeout=10
 > git branch -a -v --no-abbrev # timeout=10
 > git branch -D master # timeout=10
 > git checkout -b master d24abcbc136a3f050b9c1aa365bf30dcc6b77bb9 # timeout=10
Commit message: "[docs] add jenkinsfiles"
 > git rev-list --no-walk d24abcbc136a3f050b9c1aa365bf30dcc6b77bb9 # timeout=10
[Pipeline] }
[Pipeline] // stage
[Pipeline] stage
[Pipeline] { (publish)
[Pipeline] sh
+ git config --global user.email jiangtingqiang@gmail.com
[Pipeline] sh
+ git config --global user.name ****
[Pipeline] sh
+ git add -A
[Pipeline] sh
+ git diff-index --quiet HEAD
[Pipeline] sh
+ echo ****
****
[Pipeline] sh
+ echo

[Pipeline] sh
+ git push https://****:@github.com/****/xiaoqiang-blog-source.git
remote: Invalid username or password.
fatal: Authentication failed for 'https://****:@github.com/****/xiaoqiang-blog-source.git/'
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // withCredentials
[Pipeline] }
[Pipeline] // withEnv
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 128
Finished: FAILURE

我是否遗漏了配置凭据中的某些内容？

【问题讨论】：

标签： jenkins

【解决方案1】：

您不能按原样使用 jenkins 凭据。

请查看thisstackoverflow 答案，说明如何从 bash 脚本运行推送。

【讨论】：

【解决方案2】：

这里我不回答如何使用 git。我的回答是关于 jenkins 中的秘密使用情况。

您使用了哪种秘密？密文？

在使用秘密 - 用户名和密码时，您可以像这样单独调用用户名和密码：

agent { 
        node {
            label 'jenkins-master'
        }
    }

    environment {
        GITHUB_CRED = credentials('github-cred')
    }

    stages {  
       stage('publish') {
            steps{
                sh "echo ${GITHUB_CRED_USR}"
                sh "echo ${GITHUB_CRED_PSW}"
                sh "git push https://${GITHUB_CRED_USR}:${GITHUB_CRED_PSW}@github.com/jiangxiaoqiang/jiangxiaoqiang.github.io.git"
            }
        }
    }
}

您将凭据存储在哪里也很有意义：在全局或项目范围内。

【讨论】：