Configure Jenkins for Deploy Change Investigator

Send build and deployment webhooks from your pipelines

Configure Jenkins pipelines to send build and deployment data to the Deploy Change Investigator using shell scripts.

Before you begin

Deploy Change Investigator setup: Create build and deploy webhook integrations in AI SRE. Go to Deploy Change Investigator to set up the integrations.
Jenkins pipeline access: Permission to edit the Jenkinsfile or add build steps.
Webhook URLs: Copy the build and deploy webhook URLs from your AI SRE integrations.
Git plugin: Ensure the Jenkins Git plugin is installed for commit SHA access.

WHY JENKINS NEEDS SCRIPTS

Jenkins does not have native webhook notification support like GitHub Actions or GitLab CI. Use shell scripts with curl to send webhook POST requests at the end of build and deploy stages.

Configure build webhooks

Add a shell script step to your Jenkins build pipeline that runs after the artifact is published.

Declarative pipeline

Add this step to your post section or as the last step in your build stage:

pipeline {
    agent any
    
    environment {
        BUILD_WEBHOOK_URL = credentials('aisre-build-webhook-url')
        ARTIFACT_REGISTRY = 'docker.example.com'
        SERVICE_NAME = 'myapp'
    }
    
    stages {
        stage('Build') {
            steps {
                // Your build steps here
                sh 'docker build -t ${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${BUILD_NUMBER} .'
                sh 'docker push ${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${BUILD_NUMBER}'
            }
        }
    }
    
    post {
        success {
            script {
                sh '''#!/bin/bash
                    json_payload="{\
                    \\"artifact\\": {\\"name\\": \\"${ARTIFACT_REGISTRY}/${SERVICE_NAME}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
                    \\"source\\": {\
                    \\"commitSha\\": \\"${GIT_COMMIT}\\",\
                    \\"kind\\": \\"branch\\",\
                    \\"value\\": \\"${GIT_BRANCH}\\",\
                    \\"repository_url\\": \\"${GIT_URL}\\"},\
                    \\"service\\": {\\"name\\": \\"${SERVICE_NAME}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
                    \\"buildId\\": \\"${BUILD_ID}\\"}"
                    
                    curl "${BUILD_WEBHOOK_URL}" \\
                      -s \\
                      -H "Content-Type: application/json" \\
                      -d "${json_payload}"
                '''
            }
        }
    }
}

Scripted pipeline

node {
    def artifactRegistry = 'docker.example.com'
    def serviceName = 'myapp'
    def buildWebhookUrl = env.BUILD_WEBHOOK_URL
    
    stage('Build') {
        // Your build steps
        sh "docker build -t ${artifactRegistry}/${serviceName}:${BUILD_NUMBER} ."
        sh "docker push ${artifactRegistry}/${serviceName}:${BUILD_NUMBER}"
    }
    
    stage('Notify Build Complete') {
        sh """#!/bin/bash
            json_payload="{\
            \\"artifact\\": {\\"name\\": \\"${artifactRegistry}/${serviceName}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
            \\"source\\": {\
            \\"commitSha\\": \\"${GIT_COMMIT}\\",\
            \\"kind\\": \\"branch\\",\
            \\"value\\": \\"${GIT_BRANCH}\\",\
            \\"repository_url\\": \\"${GIT_URL}\\"},\
            \\"service\\": {\\"name\\": \\"${serviceName}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
            \\"buildId\\": \\"${BUILD_ID}\\"}"
            
            curl "${buildWebhookUrl}" \\
              -s \\
              -H "Content-Type: application/json" \\
              -d "\${json_payload}"
        """
    }
}

Environment variables reference

Jenkins provides these environment variables automatically:

GIT_COMMIT: Full SHA of the commit being built.
GIT_BRANCH: Branch name (for example, origin/main).
GIT_URL: Git repository URL.
BUILD_ID: Unique Jenkins build ID.
BUILD_NUMBER: Sequential build number.

Custom variables to set:

BUILD_WEBHOOK_URL: Store as a Jenkins credential (Secret text).
ARTIFACT_REGISTRY: Your Docker or artifact registry URL.
SERVICE_NAME: Service identifier.

Configure deploy webhooks

Add a shell script step to your Jenkins deployment pipeline that runs after the deployment completes.

Declarative pipeline

pipeline {
    agent any
    
    environment {
        DEPLOY_WEBHOOK_URL = credentials('aisre-deploy-webhook-url')
        SERVICE_NAME = 'myapp'
        SERVICE_VERSION = '1.2.3'  // Pass from build job
        DEPLOY_ENV = 'production'
    }
    
    stages {
        stage('Deploy') {
            steps {
                // Your deployment steps here
                sh 'kubectl set image deployment/${SERVICE_NAME} ${SERVICE_NAME}=${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${SERVICE_VERSION}'
            }
        }
    }
    
    post {
        success {
            script {
                sh '''#!/bin/bash
                    json_payload="{\
                    \\"services\\": [{\\"service\\": \\"${SERVICE_NAME}\\", \\"version\\": \\"${SERVICE_VERSION}\\"}],\
                    \\"environments\\": [\\"${DEPLOY_ENV}\\"],\
                    \\"changeId\\": \\"${BUILD_ID}\\",\
                    \\"status\\": \\"SUCCESS\\",\
                    \\"deployedBy\\": \\"${BUILD_USER}\\",\
                    \\"deployTimestamp\\": \\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"}"
                    
                    curl "${DEPLOY_WEBHOOK_URL}" \\
                      -s \\
                      -H "Content-Type: application/json" \\
                      -d "${json_payload}"
                '''
            }
        }
        failure {
            script {
                sh '''#!/bin/bash
                    json_payload="{\
                    \\"services\\": [{\\"service\\": \\"${SERVICE_NAME}\\", \\"version\\": \\"${SERVICE_VERSION}\\"}],\
                    \\"environments\\": [\\"${DEPLOY_ENV}\\"],\
                    \\"changeId\\": \\"${BUILD_ID}\\",\
                    \\"status\\": \\"FAILURE\\",\
                    \\"deployedBy\\": \\"${BUILD_USER}\\",\
                    \\"deployTimestamp\\": \\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"}"
                    
                    curl "${DEPLOY_WEBHOOK_URL}" \\
                      -s \\
                      -H "Content-Type: application/json" \\
                      -d "${json_payload}"
                '''
            }
        }
    }
}

DEPLOY STATUS IS RECORDED AS SUCCESS

The stock Harness Deployment template records every deploy activity as success. Sending a FAILURE status is accepted but does not create a failed-deployment record. Keep the failure webhook if you want the deploy event captured, but do not rely on the status value to distinguish failed deploys.

Multi-service deployments

For deployments that update multiple services:

post {
    success {
        script {
            sh '''#!/bin/bash
                json_payload="{\
                \\"services\\": [\
                {\\"service\\": \\"frontend\\", \\"version\\": \\"${FRONTEND_VERSION}\\"},\
                {\\"service\\": \\"backend\\", \\"version\\": \\"${BACKEND_VERSION}\\"},\
                {\\"service\\": \\"worker\\", \\"version\\": \\"${WORKER_VERSION}\\"}\
                ],\
                \\"environments\\": [\\"${DEPLOY_ENV}\\"],\
                \\"changeId\\": \\"${BUILD_ID}\\",\
                \\"status\\": \\"SUCCESS\\",\
                \\"deployedBy\\": \\"${BUILD_USER}\\",\
                \\"deployTimestamp\\": \\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"}"
                
                curl "${DEPLOY_WEBHOOK_URL}" \\
                  -s \\
                  -H "Content-Type: application/json" \\
                  -d "${json_payload}"
            '''
        }
    }
}

Store webhook URLs as credentials

Store webhook URLs securely in Jenkins:

Navigate to Manage Jenkins, then select Credentials
Select the appropriate domain (usually (global))
Click Add Credentials
Configure the following:
- Kind: Secret text
- Secret: Paste your build or deploy webhook URL
- ID: aisre-build-webhook-url or aisre-deploy-webhook-url
- Description: "AI SRE Build Webhook URL" or "AI SRE Deploy Webhook URL"
Click OK

Reference credentials in Jenkinsfile:

environment {
    BUILD_WEBHOOK_URL = credentials('aisre-build-webhook-url')
    DEPLOY_WEBHOOK_URL = credentials('aisre-deploy-webhook-url')
}

Critical mapping requirements

The Deploy Change Investigator requires exact matches between build and deploy data:

Build webhook field

Deploy webhook field

Must match

service.name

services[].service

✅ Yes

artifact.version or service.version

services[].version

✅ Yes

COMMON MISTAKES

Version mismatch: Build sends 1.2.3, deploy sends v1.2.3, so there is no match.
Service name mismatch: Build sends myapp, deploy sends my-app, so there is no match.
Using different identifiers: Ensure the BUILD_NUMBER or version tag is consistent across both webhooks.

Testing webhooks

Test build webhook

Trigger a build and confirm the webhook reaches AI SRE:

Trigger a Jenkins build that includes the webhook script
Check the Jenkins console output for curl command execution
Navigate to AI SRE, then select Integrations
Click the More icon on the BUILD integration
Select Debug to view received webhook events

Test deploy webhook

Trigger a deployment and confirm the webhook reaches AI SRE:

Trigger a deployment pipeline
Verify the curl command runs in the console output
Navigate to AI SRE, select Integrations, then select Debug on the DEPLOY integration

Verify the connection

After sending both build and deploy webhooks:

Navigate to AI SRE, then select Change Management
You should see deployment records linked to builds
Click into a deployment to see the following:
- Artifact versions
- Commit SHAs
- Linked PRs

Troubleshooting

Jenkins build webhook not received in AI SRE

Confirm the curl command runs in the Jenkins console log, verify the webhook URL credential is correct, ensure Jenkins agents allow outbound HTTPS, and check the JSON payload for syntax errors using the -v flag on curl.

Jenkins deploy webhook received but changes not showing in AI SRE

Ensure services[].service in the deploy webhook exactly matches service.name in the build webhook, and services[].version exactly matches artifact.version or service.version. Confirm both webhooks were sent by checking the Debug view for both integrations.

Getting the BUILD_USER variable in Jenkins for AI SRE deploy webhooks

Jenkins does not provide BUILD_USER by default. Install the Build User Vars Plugin to expose BUILD_USER, BUILD_USER_EMAIL, and BUILD_USER_ID, or use ${BUILD_CAUSE} or hardcode a service account name.

Example complete Jenkins pipeline

The following is a complete example with both build and deploy webhooks:

pipeline {
    agent any
    
    environment {
        BUILD_WEBHOOK_URL = credentials('aisre-build-webhook-url')
        DEPLOY_WEBHOOK_URL = credentials('aisre-deploy-webhook-url')
        ARTIFACT_REGISTRY = 'docker.example.com'
        SERVICE_NAME = 'myapp'
    }
    
    stages {
        stage('Build') {
            steps {
                sh 'docker build -t ${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${BUILD_NUMBER} .'
                sh 'docker push ${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${BUILD_NUMBER}'
            }
            post {
                success {
                    sh '''#!/bin/bash
                        json_payload="{\
                        \\"artifact\\": {\\"name\\": \\"${ARTIFACT_REGISTRY}/${SERVICE_NAME}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
                        \\"source\\": {\
                        \\"commitSha\\": \\"${GIT_COMMIT}\\",\
                        \\"kind\\": \\"branch\\",\
                        \\"value\\": \\"${GIT_BRANCH}\\",\
                        \\"repository_url\\": \\"${GIT_URL}\\"},\
                        \\"service\\": {\\"name\\": \\"${SERVICE_NAME}\\", \\"version\\": \\"${BUILD_NUMBER}\\"},\
                        \\"buildId\\": \\"${BUILD_ID}\\"}"
                        
                        curl "${BUILD_WEBHOOK_URL}" -s -H "Content-Type: application/json" -d "${json_payload}"
                    '''
                }
            }
        }
        
        stage('Deploy to Production') {
            when {
                branch 'main'
            }
            steps {
                sh 'kubectl set image deployment/${SERVICE_NAME} ${SERVICE_NAME}=${ARTIFACT_REGISTRY}/${SERVICE_NAME}:${BUILD_NUMBER}'
            }
            post {
                always {
                    script {
                        def status = currentBuild.currentResult == 'SUCCESS' ? 'SUCCESS' : 'FAILURE'
                        sh """#!/bin/bash
                            json_payload="{\
                            \\"services\\": [{\\"service\\": \\"${SERVICE_NAME}\\", \\"version\\": \\"${BUILD_NUMBER}\\"}],\
                            \\"environments\\": [\\"production\\"],\
                            \\"changeId\\": \\"${BUILD_ID}\\",\
                            \\"status\\": \\"${status}\\",\
                            \\"deployedBy\\": \\"jenkins\\",\
                            \\"deployTimestamp\\": \\"\$(date -u +%Y-%m-%dT%H:%M:%SZ)\\"}"
                            
                            curl "${DEPLOY_WEBHOOK_URL}" -s -H "Content-Type: application/json" -d "\${json_payload}"
                        """
                    }
                }
            }
        }
    }
}

Next steps

Go to Deploy Change Investigator to complete the setup.
Go to AI Agent RCA to understand how change detection works during incidents.
Go to Configure GitHub Actions to set up webhooks in GitHub Actions workflows.

PreviousHarness Code

NextJira

Last updated 10 days ago

Was this helpful?