mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
41efbeda11
Pin the MCP Server plugin and let a boot hook mint the API token MCP clients present, then take that token over into sys-token-store and verify it against the controller before the deploy continues. Wait for the controller to answer before probing. A JCasC change restarts Jenkins, and the probe carries no retries of its own, so a single 5xx during startup failed the deploy with a credential that was valid all along. Authenticate with HTTP Basic. The plugin offers no bearer, which is why basic_auth entered the service contract instead of the role working around it. Assert the guarded surface, not the handshake: the plugin answers initialize anonymously because that call is capability negotiation and carries no data, while an unauthenticated tools/list is refused and leaks no tool inventory. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
24 lines
795 B
Docker
24 lines
795 B
Docker
ARG JENKINS_IMAGE
|
|
ARG JENKINS_VERSION
|
|
FROM ${JENKINS_IMAGE}:${JENKINS_VERSION}
|
|
|
|
USER root
|
|
RUN rm -rf /var/lib/apt/lists/* \
|
|
&& apt-get -o Acquire::Retries=3 update \
|
|
&& apt-get -o Acquire::Retries=3 install -y --no-install-recommends ca-certificates curl gnupg \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
RUN chmod 0666 /opt/java/openjdk/lib/security/cacerts
|
|
COPY java-with-ca-trust.sh /usr/local/bin/java-with-ca-trust.sh
|
|
RUN chmod +x /usr/local/bin/java-with-ca-trust.sh
|
|
|
|
USER jenkins
|
|
|
|
COPY plugins.txt /usr/share/jenkins/ref/plugins.txt
|
|
RUN jenkins-plugin-cli --plugin-file /usr/share/jenkins/ref/plugins.txt
|
|
|
|
COPY mcp-api-token.groovy /usr/share/jenkins/ref/init.groovy.d/mcp-api-token.groovy.override
|
|
|
|
ENTRYPOINT ["/usr/local/bin/java-with-ca-trust.sh"]
|
|
CMD ["/usr/local/bin/jenkins.sh"]
|