Download war from mirrors unless we are publishing a release #2059

MarkEWaite · 2025-08-15T19:41:46Z

Download war from mirrors unless we are publishing a release

Reduce Artifactory bandwidth use for container builds by downloading the Jenkins war file from the nearest mirror site rather than downloading from repo.jenkins-ci.org when building without publishing.

Download from Artifactory when building to publish.

Adjust JENKINS_URL to use Artifactory when publishing and otherwise to download the Jenkins war file from the mirrors.

JENKINS_URL does not benefit from a default value because it must always be computed in docker-bake.hcl or provided as a build argument.

Helps reduce Artifactory bandwidth use as requested in:

Reduce artifactory bandwidth used by ci.jenkins.io jenkins-infra/helpdesk#4747

Testing done

Confirmed the following configurations work as expected on Linux:

Publish	Weekly	LTS
true	Artifactory	Artifactory
false	mirrors	mirrors

Tested the Windows changes in my Powershell local environment.

Did not test the build on Windows. Rely on ci.jenkins.io for that test.

Published Linux based builds to markewaite/experiments. Confirmed that that build and publish process downloaded from Artifactory.

Submitter checklist

Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
Ensure that the pull request title represents the desired changelog entry
Please describe what you did
Link to relevant issues in GitHub or Jira
Link to relevant pull requests, esp. upstream and downstream changes
Ensure you have provided tests that demonstrate the feature works or the issue is fixed

Reduce Artifactory bandwidth use for container builds by downloading the Jenkins war file from the nearest mirror site rather than downloading from repo.jenkins-ci.org when building without publishing. Download from Artifactory when building to publish. Adjust JENKINS_URL to use Artifactory when publishing and otherwise to download the Jenkins war file from the mirrors. Testing done: Confirmed the following configurations work as expected on Linux: | Publish | Weekly | LTS | | ------- | ----------- | ----------- | | true | Artifactory | Artifactory | | false | mirrors | mirrors | Tested the Windows changes in my Powershell local environment. Did not test the build on Windows. Rely on ci.jenkins.io for that test. Published Linux based builds to markewaite/experiments. Confirmed that that build and publish process downloaded from Artifactory. JENKINS_URL does not benefit from a default value because it must always be computed in docker-bake.hcl or provided as a build argument. Helps reduce Artifactory bandwidth use as requested in: * jenkins-infra/helpdesk#4747

Previously the AdditionalArgs was being defined and then never used. No need to append to a variable that does not exist. Use a simpler name for the variable.

MarkEWaite · 2025-08-15T22:51:25Z

The failing Windows tests are more than I'm ready to manage today. I may spend additional time on this later. I'm glad that it builds and tests as expected on Linux and glad that it builds on Windows. Failing windows tests will wait for another day.

dduportal

A few comments and pointers aiming to simplify the proposed change (same idea, but with less changes and less code to make it easier to maintain)

dduportal · 2025-08-18T19:01:53Z

alpine/hotspot/Dockerfile

@@ -90,13 +90,13 @@ RUN mkdir -p ${REF}/init.groovy.d

 # jenkins version being bundled in this docker image
 ARG JENKINS_VERSION
-ENV JENKINS_VERSION=${JENKINS_VERSION:-2.504}
+ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}


Suggested change

ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}

ENV JENKINS_VERSION=${JENKINS_VERSION}

In order to avoid spreading the same value on multiple locations, which makes it tedious to maintain, WDYT about avoiding passing any default version?

We keep the ENV to ensure the resolved value is stored in the image (ARG is only available during build) but no default value as we rely on docker bake and docker-compose

dduportal · 2025-08-18T19:02:36Z

alpine/hotspot/Dockerfile


 # jenkins.war checksum, download will be validated using it
-ARG JENKINS_SHA=efc91d6be8d79dd078e7f930fc4a5f135602d0822a5efe9091808fdd74607d32
+ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a


Suggested change

ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a

ARG JENKINS_SHA

WDYT we apply the same pattern as other ARGs and we rely only on docker bake/compose to avoid spreading the values on many locations?

That changes the development experience by requiring that every invocation of make must provide a value for JENKINS_SHA and JENKINS_VERSION. We might be able to overcome that by allowing the Makefile to request the SHA based on the JENKINS_VERSION using the same technique that is in the .ci/publish.sh script, but that seems like it will increase the complexity and remove some of the simplification that you would like to see.

dduportal · 2025-08-18T19:04:00Z

tests/test_helpers.psm1

@@ -105,7 +105,7 @@ function Run-Program($cmd, $params, $verbose=$false) {
 }

 function Build-Docker($tag) {
-    $exitCode, $stdout, $stderr = Run-Program 'docker-compose' '--file=build-windows.yaml build --parallel'
+    $exitCode, $stdout, $stderr = Run-Program 'docker-compose' '--file=build-windows.yaml build --parallel --build-arg JENKINS_URL=' + $env:JENKINS_URL


Instead of changing the compose call, WDYT if we rely on https://docs.docker.com/compose/how-tos/environment-variables/set-environment-variables/#additional-information instead?

dduportal · 2025-08-18T19:09:11Z

docker-bake.hcl

@@ -94,6 +94,12 @@ variable "BOOKWORM_TAG" {
  default = "20250721"
 }

+variable "JENKINS_URL" { }


Suggested change

variable "JENKINS_URL" { }

variable "JENKINS_URL" {

default = "https://repo.jenkins-ci.org/public/org/jenkins-ci/main/jenkins-war/${JENKINS_VERSION}/jenkins-war-${JENKINS_VERSION}.war"

}

WDYT if we define the "most common" value here (e.g. the current default which will be kept) and we only define a custom URL on the ci.jenkins.io pipeline? The goal would be to avoid the tedious logic around our "war" / "war-stable" detection. Your code works marvelously but it is still some branching code to maintain inside a declarative (docker bake) system

I tried that as one of my first iterations and was unable to persuade the bake file to expand the value of JENKINS_VERSION at the correct time. I abandoned the idea because no other variable in the file uses other variables to expand them.

If there is a way to do that, I'm open to it. I couldn't make it work with my efforts.

I'd like to take a shot at it. Is this PR urgent?

I'd like to take a shot at it. Is this PR urgent?

Not at all. I'd love to have you look at it when you're back from vacation.

dduportal · 2025-08-18T19:09:58Z

Jenkinsfile

-// Default environment variable set to allow images publication
-def envVars = ['PUBLISH=true']
+// Only publish images from trusted.ci.jenkins.io
+def envVars = ['PUBLISH=' + env.JENKINS_URL.startsWith('https://trusted.ci.jenkins.io')]


Ideally, we should not need this detection (see my comment about default value)

MarkEWaite added the chore label Aug 15, 2025

MarkEWaite requested a review from a team as a code owner August 15, 2025 19:41

MarkEWaite added 4 commits August 15, 2025 14:11

Set JENKINS_URL env in Windows builds

2f3ad8b

Only publish from trusted.ci.jenkins.io

681df4c

Simplify JENKINS_URL addition in Powershell

8d43ef0

Previously the AdditionalArgs was being defined and then never used. No need to append to a variable that does not exist. Use a simpler name for the variable.

Add JENKINS_URL to Build-Docker test helper

c1a9aef

dduportal reviewed Aug 18, 2025

View reviewed changes

MarkEWaite marked this pull request as draft August 19, 2025 15:40

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Download war from mirrors unless we are publishing a release #2059

Download war from mirrors unless we are publishing a release #2059

Uh oh!

MarkEWaite commented Aug 15, 2025

Uh oh!

MarkEWaite commented Aug 15, 2025

Uh oh!

dduportal left a comment

Uh oh!

dduportal Aug 18, 2025

Uh oh!

dduportal Aug 18, 2025

Uh oh!

MarkEWaite Aug 18, 2025

Uh oh!

dduportal Aug 18, 2025

Uh oh!

dduportal Aug 18, 2025

Uh oh!

MarkEWaite Aug 18, 2025

Uh oh!

lemeurherveCB Aug 18, 2025

Uh oh!

MarkEWaite Aug 18, 2025

Uh oh!

dduportal Aug 18, 2025

Uh oh!

Uh oh!

	ENV JENKINS_VERSION=${JENKINS_VERSION:-2.516.1}
	ENV JENKINS_VERSION=${JENKINS_VERSION}

	ARG JENKINS_SHA=c308a27e81f4ce3aa6787e96caf771534f7f206fefbb83969d77b15fc7f2700a
	ARG JENKINS_SHA

Uh oh!

Download war from mirrors unless we are publishing a release #2059

Are you sure you want to change the base?

Download war from mirrors unless we are publishing a release #2059

Uh oh!

Conversation

MarkEWaite commented Aug 15, 2025