Allows various kinds of credentials (secrets) to be used in idiosyncratic ways. Each binding will define an environment variable active within the scope of the step. You can then use them directly from any other steps that expect environment variables to be set:
node {
withCredentials([usernameColonPassword(credentialsId: 'mylogin', variable: 'USERPASS')]) {
sh '''
set +x
curl -u $USERPASS https://private.server/ > output
'''
}
}
As another example (use Snippet Generator to see all options):
node {
withCredentials([string(credentialsId: 'mytoken', variable: 'TOKEN')]) {
sh '''
set +x
curl -H "Token: $TOKEN" https://some.api/
'''
}
}
or retrieve values from Groovy code via the env
magic variable:
def password = env.PASSWORD
Note that some steps explicitly ask for credentials of a particular kind,
usually as a credentialsId
parameter,
in which case this step is unnecessary.
For bindings which store a secret file, beware that
node {
dir('subdir') {
withCredentials([file(credentialsId: 'secret', variable: 'FILE')]) {
sh 'use $FILE'
}
}
}
is not safe, as $FILE
might be inside the workspace (in subdir@tmp/secretFiles/
),
and thus visible to anyone able to browse the job’s workspace.
If you need to run steps in a different directory than the usual workspace, you should instead use
node {
withCredentials([file(credentialsId: 'secret', variable: 'FILE')]) {
dir('subdir') {
sh 'use $FILE'
}
}
}
to ensure that the secrets are outside the workspace; or choose a different workspace entirely:
node {
ws {
withCredentials([file(credentialsId: 'secret', variable: 'FILE')]) {
sh 'use $FILE'
}
}
}