Hudson - control of Execute shell Command

[Jim Thompson]

Greetings!

Have been playing with Hudson and find it to be a nice intuitive tool.

One of my rather vanilla jobs works like this:
- monitor a Subversion repo Url on a schedule
- when a change is detected, execute a shell command.

That shell command and its parameters look kinda like this:

/export/xxxx/run-remote-script.pl \
-remote_account=trantest@xxxxx \
-remote_script='/Transcript/xxxx/update-and-build' \
-mail_to=jfthomps@xxxxxxxx,john.knox@xxxxxxx \
-mail_subject='Transcript - trantest update and build executed (reg)' \
-debug=1

As one might guess, the script will ssh to -remote_account, run -remote_script and email results to -mail_to with -mail_subject (if the ssh connection has been authorized).

If we are going to make Hudson available to multiple users, there are some concerns about allowing folks to run scripts on the Hudson server (we're less concerned with what they run on their remote server).  I think we could reduce some concerns if we could check what is entered in the "Execute shell - Command" box (e.g., must start with /export/xxxx/run-remote-script.pl ).

While users are setting up jobs, is there a way to edit (and optionally reject) what is entered in the Command box?

Thanks,
Jim





---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[Sreekanth B]

Hi

On Tue, Aug 24, 2010 at 10:28 PM, Jim Thompson <[hidden email]> wrote:

Greetings!

Have been playing with Hudson and find it to be a nice intuitive tool.

One of my rather vanilla jobs works like this:
- monitor a Subversion repo Url on a schedule
- when a change is detected, execute a shell command.

That shell command and its parameters look kinda like this:

/export/xxxx/run-remote-script.pl \
-remote_account=trantest@xxxxx \
-remote_script='/Transcript/xxxx/update-and-build' \
-mail_to=jfthomps@xxxxxxxx,john.knox@xxxxxxx \
-mail_subject='Transcript - trantest update and build executed (reg)' \
-debug=1

As one might guess, the script will ssh to -remote_account, run -remote_script and email results to -mail_to with -mail_subject (if the ssh connection has been authorized).

If we are going to make Hudson available to multiple users, there are some concerns about allowing folks to run scripts on the Hudson server (we're less concerned with what they run on their remote server).  I think we could reduce some concerns if we could check what is entered in the "Execute shell - Command" box (e.g., must start with /export/xxxx/run-remote-script.pl ).

While users are setting up jobs, is there a way to edit (and optionally reject) what is entered in the Command box?

Write a custom plug-in ;-)

-S 

[Ash Lux]

Sreekanth's solution of a custom plugin looks reasonable and should be easy enough to pull off. The problem is, I don't think it's possible to remove the execution build steps (bash, batch).

Thinking out loud here: Run Hudson as a system user (say, hudson) and only give it permission to execute run-remote-script.pl.

I'm always looking for ways to eliminate custom written code, so depending on what you're emailing you might be able to replace the email functionality of that script with Hudson's email-ext plugin.

Ash Lux

On Tue, Aug 24, 2010 at 11:58, Jim Thompson <[hidden email]> wrote:

Greetings!

Have been playing with Hudson and find it to be a nice intuitive tool.

One of my rather vanilla jobs works like this:
- monitor a Subversion repo Url on a schedule
- when a change is detected, execute a shell command.

That shell command and its parameters look kinda like this:

/export/xxxx/run-remote-script.pl \
-remote_account=trantest@xxxxx \
-remote_script='/Transcript/xxxx/update-and-build' \
-mail_to=jfthomps@xxxxxxxx,john.knox@xxxxxxx \
-mail_subject='Transcript - trantest update and build executed (reg)' \
-debug=1

As one might guess, the script will ssh to -remote_account, run -remote_script and email results to -mail_to with -mail_subject (if the ssh connection has been authorized).

If we are going to make Hudson available to multiple users, there are some concerns about allowing folks to run scripts on the Hudson server (we're less concerned with what they run on their remote server).  I think we could reduce some concerns if we could check what is entered in the "Execute shell - Command" box (e.g., must start with /export/xxxx/run-remote-script.pl ).

While users are setting up jobs, is there a way to edit (and optionally reject) what is entered in the Command box?

Thanks,
Jim

---------------------------------------------------------------------
To unsubscribe, e-mail: [hidden email]
For additional commands, e-mail: [hidden email]

[Dean Yu]

If you’re going to write a plugin, you could remove the Execute Shell Command build step entirely as part of that plugin.

  -- Dean


On 8/24/10 11:09 AM, "Ash Lux" <ashlux@...> wrote:

Sreekanth's solution of a custom plugin looks reasonable and should be easy enough to pull off. The problem is, I don't think it's possible to remove the execution build steps (bash, batch).

Thinking out loud here: Run Hudson as a system user (say, hudson) and only give it permission to execute run-remote-script.pl <http://run-remote-script.pl> .

I'm always looking for ways to eliminate custom written code, so depending on what you're emailing you might be able to replace the email functionality of that script with Hudson's email-ext plugin <http://wiki.hudson-ci.org/display/HUDSON/Email-ext+plugin> .

Ash Lux

On Tue, Aug 24, 2010 at 11:58, Jim Thompson <jfthomps@...> wrote:

Greetings!

Have been playing with Hudson and find it to be a nice intuitive tool.

One of my rather vanilla jobs works like this:
- monitor a Subversion repo Url on a schedule
- when a change is detected, execute a shell command.

That shell command and its parameters look kinda like this:

/export/xxxx/run-remote-script.pl <http://run-remote-script.pl>  \
-remote_account=trantest@xxxxx \
-remote_script='/Transcript/xxxx/update-and-build' \
-mail_to=jfthomps@xxxxxxxx,john.knox@xxxxxxx \
-mail_subject='Transcript - trantest update and build executed (reg)' \
-debug=1

As one might guess, the script will ssh to -remote_account, run -remote_script and email results to -mail_to with -mail_subject (if the ssh connection has been authorized).

If we are going to make Hudson available to multiple users, there are some concerns about allowing folks to run scripts on the Hudson server (we're less concerned with what they run on their remote server).  I think we could reduce some concerns if we could check what is entered in the "Execute shell - Command" box (e.g., must start with /export/xxxx/run-remote-script.pl <http://run-remote-script.pl>  ).

While users are setting up jobs, is there a way to edit (and optionally reject) what is entered in the Command box?

Thanks,
Jim





---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...