Prevent absolute links from adoc to www.jenkins.io and jenkins.io

[MarkEWaite]

Prevent absolute links to jenkins.io and www.jenkins.io in adoc files

When the https://www.jenkins.io/ URL is embedded in the source code of the jenkins.io pages, it causes a user exploring a pull request through the preview sites to be moved from the preview site to the www.jenkins.io site. If they are not very carefully watching the URL address bar, they can waste time looking at the production site when they wanted to review the preview site.

• Prevent absolute links to jenkins.io or www.jenkins.io and use relative instead #5718
• Use site local links #5715

@ADITYADAS1999 I assumed that the issue was more difficult than you were ready to attack. If you'd like to review the technique I've used, I'd love to have comments or recommendations of ways it could be improved.

[daniel-beck]

Please make execution of make check non-fatal on builds running on trusted.ci (or just skip it in the Jenkinsfile for env.BRANCH_NAME == null), otherwise this can block publication of security advisories.

[MarkEWaite]

Please make execution of make check non-fatal on builds running on trusted.ci (or just skip it in the Jenkinsfile for env.BRANCH_NAME == null), otherwise this can block publication of security advisories.

Thanks for reminding me of that case. I adapted the shell script to never fail if run on trusted.ci.jenkins.io in 185fbf8

[dduportal]

Please make execution of make check non-fatal on builds running on trusted.ci (or just skip it in the Jenkinsfile for env.BRANCH_NAME == null), otherwise this can block publication of security advisories.

Thanks for reminding me of that case. I adapted the shell script to never fail if run on trusted.ci.jenkins.io in 185fbf8

WDYT about adding a condition on renew the signer certificate for jenkins instead?

It would use https://github.com/jenkins-infra/pipeline-library#infraistrusted :

if (!infra.isTrusted()) {
      stage('Check for typos') {
          sh 'make check'
          recordIssues(tools: [checkStyle(id: 'typos', name: 'Typos', pattern: 'checkstyle.xml')], qualityGates: [[threshold: 1, type: 'TOTAL', unstable: true]])
    }
}

Advantages:

• Simpler shell script
• No risk to bother contributors running the shell script locally
• Scoped to only our environements
• Trustable check: the pipeline-library is better source of trust than checking an environment variable

(but I might be not pointing in the correct direction, WDYT @daniel-beck ?)

[MarkEWaite]

Advantages:

• Simpler shell script
• No risk to bother contributors running the shell script locally
• Scoped to only our environments
• Trustable check: the pipeline-library is better source of trust than checking an environment variable

(but I might be not pointing in the correct direction, WDYT @daniel-beck ?)

If infra.isTrusted() is already available in that context, then it is a much better choice. Checking for typographical errors and for content errors is well suited to being done in pull request evaluation and even somewhat on the master branch in the untrusted environment of ci.jenkins.io. Those checks don't make as much sense in the deployment environment, because they are advisory checks that should not block deployment.

[daniel-beck]

Inconsistent with

jenkins.io/Jenkinsfile

Line 92 in f9472d3

if (env.BRANCH_NAME == null) {

[MarkEWaite]

Included in d67b1ba with a comment to clarify why two conditions are being checked.

[MarkEWaite]

@daniel-beck does the change in d67b1ba address your concerns enough that this can be merged or are more changes required?

[dduportal]

Please make execution of make check non-fatal on builds running on trusted.ci (or just skip it in the Jenkinsfile for env.BRANCH_NAME == null), otherwise this can block publication of security advisories.

Ping @daniel-beck , is it ok for you (as GitHub indicates "Merging can be performed automatically once the requested changes are addressed.")?

Changes addressed

[mukul-kr]

Where is this infra.isTrusted defined?
I was just looking around.

[hervelemeur]

Here: https://github.com/jenkins-infra/pipeline-library/blob/master/vars/infra.groovy

It allows to determine if the current build is run from trusted.ci.jenkins.io or not.

[mukul-kr]

Thank you for explaining that. I have one follow up question. So basically we are importing that from another repository. I have imported groovyscript in the same repo by using load "path to script" but here how is this import from different repo done?