Jenkins流水线部署至Render API时的JSON Payload curl请求问题

我尝试通过Jenkins流水线将服务部署至Render平台，该部署需向Render API发送带JSON payload的POST请求。但发送JSON payload时持续报错，怀疑问题与payload格式或curl命令中的传递方式有关。以下是我的Jenkins流水线阶段代码：

stage('Deploy to Render') {
    steps {
        withCredentials([string(credentialsId: 'render-credentials', variable: 'RENDER_API_KEY')]) {
            script {
                def payload = """
                {
                    "serviceId": "${SERVICE_ID}",
                    "clearCache": true
                }
                """.trim()

                sh """
                curl -v -X POST \
                    -H "Authorization: Bearer \$RENDER_API_KEY" \
                    -H "Content-Type: application/json" \
                    -d '${payload}' \
                    https://api.render.com/v1/services/${SERVICE_ID}/deploys
                """
            }
        }
    }
}

请问我用三重引号构建JSON payload并通过-d参数传递的方式是否正确？

你当前的写法存在潜在风险，并非最佳实践，大概率是导致报错的原因，具体问题和修正方案如下：

问题根源 #

1. 字符转义冲突：Groovy将payload内容插入shell脚本的单引号中时，若SERVICE_ID包含特殊字符（如双引号、反斜杠、空格），会直接破坏JSON结构，导致API解析失败。
2. shell语法风险：如果后续payload扩展包含单引号，会直接导致shell命令语法错误——单引号在shell中无法嵌套。

修正方案 #

方案1：直接在curl参数中构建转义后的JSON #

通过转义JSON中的双引号，直接在curl的-d参数中定义payload，避免Groovy与shell的引号冲突：

stage('Deploy to Render') {
    steps {
        withCredentials([string(credentialsId: 'render-credentials', variable: 'RENDER_API_KEY')]) {
            script {
                sh """
                curl -v -X POST \
                    -H "Authorization: Bearer \$RENDER_API_KEY" \
                    -H "Content-Type: application/json" \
                    -d "{
                        \\"serviceId\\": \\"${SERVICE_ID}\\",
                        \\"clearCache\\": true
                    }" \
                    https://api.render.com/v1/services/${SERVICE_ID}/deploys
                """
            }
        }
    }
}

方案2：用JsonBuilder生成标准JSON，配合Here-doc传递 #

使用Groovy的JsonBuilder确保JSON格式绝对正确，再通过shell的Here-doc传递payload，彻底避免引号问题：

stage('Deploy to Render') {
    steps {
        withCredentials([string(credentialsId: 'render-credentials', variable: 'RENDER_API_KEY')]) {
            script {
                def payload = new groovy.json.JsonBuilder([
                    serviceId: SERVICE_ID,
                    clearCache: true
                ]).toString()

                sh """
                curl -v -X POST \
                    -H "Authorization: Bearer \$RENDER_API_KEY" \
                    -H "Content-Type: application/json" \
                    -d @- << EOF
${payload}
EOF
                    https://api.render.com/v1/services/${SERVICE_ID}/deploys
                """
            }
        }
    }
}

方案3：将payload写入临时文件传递 #

把JSON内容写入临时文件，通过curl的-d @文件名读取，最稳妥且易调试：

stage('Deploy to Render') {
    steps {
        withCredentials([string(credentialsId: 'render-credentials', variable: 'RENDER_API_KEY')]) {
            script {
                writeFile file: 'deploy-payload.json', text: """
                {
                    "serviceId": "${SERVICE_ID}",
                    "clearCache": true
                }
                """.trim()

                sh """
                curl -v -X POST \
                    -H "Authorization: Bearer \$RENDER_API_KEY" \
                    -H "Content-Type: application/json" \
                    -d @deploy-payload.json \
                    https://api.render.com/v1/services/${SERVICE_ID}/deploys
                """
                delete file: 'deploy-payload.json'
            }
        }
    }
}

内容的提问来源于stack exchange，提问作者kmaili aymen