Artifacts, stash/unstash, archiveArtifacts, Fingerprints, Test Reports, Coverage, and Build Evidence: Configuration, Design Choices, and Tradeoffs

1. Start with the lifecycle question, not the Jenkins step

“Should I use stash or archiveArtifacts?” is incomplete until you state who needs the bytes, for how long, and for what purpose. The same file may pass through several states: generated in a workspace, stashed for a later test stage, archived with the CI build, then published to a release repository. Those are not duplicates; each transition serves a different ownership and retention contract.

2. Stash vs archiveArtifacts vs external artifact repository

Jenkins documents artifact archiving as useful basic retention, not a replacement for a repository manager such as Nexus or Artifactory. For production releases, the external repository usually becomes the distribution system of record while Jenkins retains build evidence and the exact published coordinates/digest.

3. Fingerprint vs cryptographic provenance

A Jenkins fingerprint answers dependency-lineage questions inside Jenkins. A SHA-256 digest answers whether two byte sequences are identical with modern cryptographic collision resistance. A signature or provenance attestation answers stronger questions about who/what asserted a build statement and how the artifact was produced. These controls are complementary.

4. Raw report versus Jenkins visualization

Raw XML is portable and can be archived. Jenkins-native report ingestion adds searchable failure/test history, trends, stage annotations, and quality-gate status. The tradeoff is plugin ownership: parser behavior and UI storage become version-sensitive operational dependencies.

A good pattern keeps the original report file when it has audit/debug value, records the producer tool/schema version, and also ingests it into Jenkins for developer feedback. Do not treat a pretty dashboard as the only copy of evidence.

5. Retain forever vs bounded retention

Retention should follow policy, not convenience. CI snapshots may have short retention; release artifacts may belong in an immutable repository for years; security/audit evidence may have policy-defined retention. Jenkins controller disks should not silently become the organization’s permanent package store.

When using build discarder policies, first classify which build records are still referenced by releases, investigations, or regulatory requirements. Deleting a build can remove artifacts and reports that a human expected to remain available.

6. Default artifact manager vs external Artifact Manager

Jenkins can delegate artifact/stash storage through Artifact Manager plugins. That can reduce controller data transfer and move storage durability/scaling to an object store. It also adds an external dependency, credentials/IAM scope, network path, plugin compatibility, and disaster-recovery requirement.

7. Worked scenario: release candidate for a CLI tool

A team builds cli-2.4.0-rc.1.tgz, runs unit tests on a second agent, and wants a later release job to promote exactly those bytes. Choose the design before writing Jenkinsfile code.

8. Cost and performance implications

• Large stashes can consume compression CPU and I/O; external Artifact Managers can alter the transfer path.
• Thousands of tiny fingerprints consume metadata/database resources; fingerprint intentional outputs/dependencies rather than **/*.
• Coverage source retention can copy significant source data into build records; choose NEVER, LAST_BUILD, MODIFIED, or EVERY_BUILD intentionally.
• Retention must include logs, artifacts, test/coverage data, and external storage cost—not just Jenkins build count.

9. Keep ownership boundaries explicit

Jenkins knows its job/build record and whatever plugins persist. The agent owns transient workspace bytes. The artifact repository owns published packages. The SCM owns source history. A deployment target owns runtime state. Troubleshooting and audit become much easier when each system has a stable identifier and Jenkins stores enough correlation evidence—including the exact source SHA—to join those records without pretending to own them all.

Knowledge check

Official references and version notes

• Pipeline: Basic Steps reference — current stash/unstash semantics and guidance for cross-stage transfer.
• Running Pipelines — Declarative stage restart and preserveStashes behavior.
• Recording tests and artifacts — archiveArtifacts, fingerprinting, and JUnit publishing patterns.
• Jenkins fingerprints — dependency/use tracking and the MD5-based fingerprint record.
• JUnit plugin — maintained test-result ingestion and build/test history.
• Coverage plugin — maintained coverage ingestion, quality gates, and source-retention choices.
• Coverage Pipeline step reference — current recordCoverage parameters and supported parsers.
• Artifact Manager on S3 plugin — optional example of external artifact-manager integration; not required by the labs.
• Jenkins LTS changelog — current LTS and tested Java configurations.