Skip to content

chore(windows): fortify build scripts against environment leaks and silent crashes - #2412

Open
Piyush0049 wants to merge 2 commits into
jenkinsci:masterfrom
Piyush0049:chore/windows-build-robustness
Open

chore(windows): fortify build scripts against environment leaks and silent crashes#2412
Piyush0049 wants to merge 2 commits into
jenkinsci:masterfrom
Piyush0049:chore/windows-build-robustness

Conversation

@Piyush0049

@Piyush0049 Piyush0049 commented Jul 16, 2026

Copy link
Copy Markdown
Contributor

While working with the Windows build scripts, I noticed several areas where terminating exceptions (like a failing Docker build or a crashing Pester test) would bypass cleanup logic. This leaves temporary files on disk and leaks global environment variables into the developer session, which can silently hijack subsequent local builds.

This PR does the following:

  1. Prevents Env Leaks: Wraps $env:WINDOWS_VERSION_OVERRIDE, $env:DOCKERHUB_ORG_REPO, and $env:CONTROLLER_TAG in try/finally blocks so they are guaranteed to be cleaned up or restored even if the build or Invoke-Pester crashes.
  2. Fixes Get-SutImage Crash: Swaps Resolve-Path for Join-Path to prevent raw ItemNotFoundException crashes, allowing the script intended friendly error message to actually render.
  3. Strict-Mode Safety: Wraps docker exec in Get-JenkinsPassword in a try/catch block to ensure forward compatibility with PS 7.3+ native command error preferences.
  4. Temp File Cleanup: Ensures Build-DockerChild deletes Dockerfile-windows.tmp in a finally block if the build fails.

Related Issues

Fixes #2413
Fixes #2414

Testing done

  • Simulated environment leaks by throwing exceptions inside the Invoke-Pester block and verified the finally blocks successfully cleaned up $env:DOCKERHUB_ORG_REPO and $env:CONTROLLER_TAG.
  • Simulated missing Dockerfiles to verify Get-SutImage now correctly outputs the friendly string error rather than crashing the script.
  • Verified that strict-mode terminating errors inside Get-JenkinsPassword are safely caught and return $null as intended.

Submitter checklist

  • Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch
  • Ensure that the pull request title represents the desired changelog entry
  • Please describe what you did
  • Link to relevant issues in GitHub or Jira
  • Link to relevant pull requests, esp. upstream and downstream changes
  • Ensure you have provided tests that demonstrate the feature works or the issue is fixed

@Piyush0049
Piyush0049 requested a review from a team as a code owner July 16, 2026 13:14
@lemeurherve

lemeurherve commented Jul 16, 2026

Copy link
Copy Markdown
Member

@Piyush0049 can you open an issue per type of problem you see so we can discuss it before opening any pull request please? It would greatly help us evaluate them before acting if needed.

@Piyush0049

Copy link
Copy Markdown
Contributor Author

@Piyush0049 can you open an issue per type of problem you see so we can discuss it before opening any pull request please? It would greatly help us evaluate them before acting if needed.

Sure, I would open issue before opening a PR from next time. I am opening the issues related to this PR.

@jenkinsci jenkinsci deleted a comment from Piyush0049 Jul 16, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

2 participants