Jenkinsfile in Depth: Stages, Credentials, Parameters, and Post Actions

Step 1: Run a pipeline from Git

Keep the Jenkinsfile at the root of your repository. In a Pipeline job, set Definition to Pipeline script from SCM, choose Git, enter the repository location, and leave Script Path as Jenkinsfile. For many branches, a Multibranch Pipeline job scans a repository and creates a job for each branch that has a Jenkinsfile.

Step 2: Structure the pipeline

A declarative pipeline has an agent, which says where to run, and stages made of steps. Options set behavior such as timeouts, and environment defines variables for the whole pipeline. The post section runs after the stages, with conditions such as always, success, and failure, which is the right place for cleanup and notifications.

pipeline {
    agent any

    options {
        timeout(time: 30, unit: 'MINUTES')
        timestamps()
        disableConcurrentBuilds()
    }

    environment {
        APP_NAME = 'my-app'
    }

    stages {
        stage('Build') {
            steps {
                sh 'echo Building $APP_NAME'
            }
        }
        stage('Test') {
            steps {
                sh 'echo Running tests'
            }
        }
    }

    post {
        always {
            echo 'Pipeline finished'
        }
        failure {
            echo 'Pipeline failed'
        }
    }
}

Step 3: Add parameters, conditions, and parallel stages

Parameters let people choose options when starting a build, and you read them through params. A when block runs a stage only when its condition is true, such as being on a certain branch. Stages inside a parallel block run at the same time, which shortens pipelines.

pipeline {
    agent any
    parameters {
        string(name: 'TARGET', defaultValue: 'staging', description: 'Where to deploy')
    }
    stages {
        stage('Checks') {
            parallel {
                stage('Unit tests') {
                    steps { sh 'echo unit tests' }
                }
                stage('Lint') {
                    steps { sh 'echo lint' }
                }
            }
        }
        stage('Deploy') {
            when { branch 'main' }
            steps {
                echo "Deploying to ${params.TARGET}"
            }
        }
    }
}

Step 4: Store and use credentials safely

Add secrets under Manage Jenkins, then Credentials, in the global store with Add Credentials. Choose the kind, such as Secret text or Username with password, and give it a meaningful ID, which cannot be changed later. In a pipeline, the credentials function in the environment block binds secret text, usernames with passwords, and secret files; for other kinds use withCredentials. Jenkins masks the values in logs.

environment {
    API_TOKEN = credentials('my-api-token')
}
steps {
    sh 'curl -H "Authorization: Bearer $API_TOKEN" https://api.example.com/health'
}

Step 5: Avoid the common credential mistake

Never put a secret inside a double-quoted Groovy string, because Groovy then interpolates the value into the command before the shell runs, and it can leak into logs. Use single quotes so the shell expands the environment variable, as in the previous example. Masking only reduces accidental exposure, so never run untrusted code with access to powerful credentials.