Artifacts, stash/unstash, archiveArtifacts, Fingerprints, Test Reports, Coverage, and Build Evidence: Diagnostics, Failure Modes, Security, and Performance

1. Evidence-first diagnostic ladder

When an artifact or report is missing, do not immediately rerun the build. A rerun can change the source revision, agent, dependency resolution, timestamped package contents, or external side effects. Preserve the original build first.

1. Record job full name, build number/URL, queue ID/cause, exact source/Jenkinsfile SHA.
2. Record Jenkins core/Java and relevant Pipeline/JUnit/Coverage plugin versions.
3. Record node, label, executor, workspace path, and first failing log lines.
4. Prove whether the producer file existed before the Jenkins step.
5. Inspect the stash/archiveArtifacts/junit/recordCoverage pattern and working directory.
6. Inspect retained artifact/report/fingerprint state on the original build.
7. Verify external repository state independently if publication was attempted.
8. Apply the smallest correction and rerun only after the original evidence packet is complete.

2. Intentionally broken example: the report exists, the glob is wrong

Assume the producer writes reports/junit.xml but the Jenkinsfile contains:

stage('Publish reports') {
  steps {
    sh 'test -s reports/junit.xml && ls -l reports/junit.xml'
    junit testResults: 'report/*.xml', allowEmptyResults: false
  }
}

The shell proves the file exists. The JUnit step then reports that no matching test report files were found. Those facts are not contradictory: the producer succeeded, but report ingestion used a different path.

Repair: preserve the original console log and build number, change only the pattern to reports/*.xml, commit the Jenkinsfile change, and run a new build. The failed build remains valuable evidence of the ingestion-layer defect.

3. Failure: stash used as long-term storage

A downstream job asks for a stash created yesterday and cannot access it. This is expected: stashes are run-scoped. Even preserved stashes are intended for Declarative stage restart, not arbitrary cross-job consumption.

Repair the architecture, not the timeout: archive the build artifact for Jenkins retention or publish it to a repository manager. Give the consumer an immutable producer identity: job/build + artifact path or repository coordinate + SHA-256.

4. Failure: an archive pattern captures a secret

The dangerous pattern is broad collection after a tool has written credentials or debug files into the workspace:

// DO NOT USE: may capture source, caches, temp files, or secrets.
archiveArtifacts artifacts: '**/*', fingerprint: true

Do not “fix” this by hiding the artifact link. Authorization and UI visibility do not undo retention. Stop publication, preserve the incident identifiers, rotate/revoke the exposed credential if it was real, remove the secret from future workspace output, narrow the archive allowlist, and follow your organization’s approved evidence-removal procedure if sensitive bytes were persisted.

5. Failure: “Fingerprint matched, therefore the artifact is authentic”

That conclusion exceeds what Jenkins fingerprints provide. The fingerprint database is useful for correlating producer and consumer builds, but its MD5 checksum is not a modern cryptographic authenticity mechanism. A matching fingerprint can help trace lineage inside Jenkins; use SHA-256 and, where required, signatures/attestations for integrity/provenance.

6. Failure: release job rebuilds instead of promoting

CI build 42 passed tests for source SHA abc…, but the release job checks out main and rebuilds. Even if main still points to the same commit, timestamps, dependency mirrors, toolchain changes, or non-reproducible build inputs can produce different bytes. The release job has lost the strongest evidence chain.

Repair the workflow by consuming the exact archived/external artifact identity from build 42, verify the digest before publication, and record the repository/deployment response. Do not “reconstruct” a release artifact from branch state when a verified artifact already exists.

7. Performance: oversized stashes and controller pressure

Pipeline Basic Steps documentation cautions that stashes use compressed TAR transfer and can demand controller CPU, especially for larger files. Symptoms can include slow stash/unstash steps, controller CPU spikes, queue delay unrelated to executor scarcity, and increased I/O. Measure before tuning.

8. Causal separation checklist

• Trigger/SCM: was the correct source SHA built?
• Queue/agent: did the intended node/workspace execute?
• Producer: did the tool create the expected file/report?
• Transfer: did stash/unstash preserve the same digest?
• Ingestion: did JUnit/Coverage parse the expected path?
• Retention: did archiveArtifacts store the intended allowlist?
• Fingerprint: was relationship metadata recorded for the exact file?
• External: did a repository accept the exact digest?

9. Security rules for evidence handling

Do not archive credentials, private keys, token files, support bundles with secrets, or broad home directories. Do not disable authorization so a consumer can retrieve artifacts. Grant build/artifact read access deliberately. Treat test reports as potentially sensitive: test names, failure messages, paths, stack traces, and captured output can reveal internal data.

When external artifact managers are used, use least-privilege service identity and verify retention/deletion semantics. Jenkins build deletion and external object deletion may be different operations.

10. Smallest safe repair

The repair target should match the failing layer. Wrong glob? Fix the glob. Missing plugin? Review/install on a disposable controller. Oversized stash? Change transfer/storage architecture. Secret captured? Rotate and narrow collection. Rebuild-during-promotion? Rewire promotion to the original immutable artifact. Avoid delete-and-recreate debugging because it destroys the history needed to prove what happened.

Knowledge check

Official references and version notes

• Pipeline: Basic Steps reference — current stash/unstash semantics and guidance for cross-stage transfer.
• Running Pipelines — Declarative stage restart and preserveStashes behavior.
• Recording tests and artifacts — archiveArtifacts, fingerprinting, and JUnit publishing patterns.
• Jenkins fingerprints — dependency/use tracking and the MD5-based fingerprint record.
• JUnit plugin — maintained test-result ingestion and build/test history.
• Coverage plugin — maintained coverage ingestion, quality gates, and source-retention choices.
• Coverage Pipeline step reference — current recordCoverage parameters and supported parsers.
• Artifact Manager on S3 plugin — optional example of external artifact-manager integration; not required by the labs.
• Jenkins LTS changelog — current LTS and tested Java configurations.