如何从Jenkins凭证管理器获取Token并在Python脚本中使用？

我有一个调用API并通过邮件返回响应的Python脚本，希望通过Jenkins流水线任务运行它。我已将一个Token以密文形式存储在Jenkins凭证管理器中（凭证ID为devadrita-stross），但不清楚如何在Python脚本中获取该Token，尝试多种方案后仍感到困惑。

原Jenkins流水线代码 #

pipeline {
    agent {
        node {
            label 'node1'
        }
    }
    environment {
        deva_stross_token=credentials('devadrita-stross') // 已将凭证保存为ID 'devadrita-stross'
    }
    stages {
        stage('running python script') {
            steps {
                script {
                    bat """
                    python -u C://Users//Administrator//Desktop//stross//stross-script.py
                    """
                }
            }       
        }
    }
}

原Python脚本 #

import requests
import urllib3
import json
import time
import os

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def initiateScan():
    url = ""

    payload={}
    files=[
    ('source',('amail.zip',open('C:/Users/Administrator/Desktop/stross/amail.zip','rb'),'application/zip')),
    ('metadata',('metadata.json',open('C:/Users/Administrator/Desktop/stross/metadata.json','rb'),'application/json'))
    ]
    headers = {
    'Authorization': ' Bearer **<token required here>**'
    }

    response = requests.request("POST", url, headers=headers, data=payload, files=files, verify=False)

    resp=response.json()
    print(resp)
    
    jobId=resp["job_id"]
    return(jobId)
    
def main():
   jobIdFromInitiate=initiateScan()

main()

修改后的Jenkins流水线代码及疑问 #

我尝试修改了Jenkins流水线代码，但仍有疑问：

pipeline {
    agent {
        node {
            label 'node1'
        }
    }
    environment {
        deva_stross_token=credentials('devadrita-stross')
    }
    withCredentials([string(credentialsId: 'devadrita-stross', variable: 'deva-stross-token')]) {
    // some block
    }
    stages {
        stage('saving stross token and printing') {
            steps {
                script {
                    bat """
                    python -u C://Users//Administrator//Desktop//stross//stross-script.py
                    """
                }
            }       
        }
    }
}

我的疑问：

1. 我已添加了读取凭证的withCredentials块，位置是否正确？
2. “将凭证绑定到环境变量”是什么意思？withCredentials块是否已将Token绑定到环境变量deva-stross-token？我的environment块是否有用或必要？
3. 如何将环境变量的值传递给我的Python脚本？

1. 正确的Jenkins流水线代码 #

withCredentials不能直接放在pipeline根节点下，必须嵌套在steps或script的执行范围内。推荐用它绑定凭证到临时环境变量，再传递给Python脚本，这里提供两种传递方式：

方式1：通过命令行参数传递Token #

pipeline {
    agent {
        node {
            label 'node1'
        }
    }
    stages {
        stage('running python script') {
            steps {
                withCredentials([string(credentialsId: 'devadrita-stross', variable: 'STROSS_TOKEN')]) {
                    script {
                        bat """
                        python -u C://Users//Administrator//Desktop//stross//stross-script.py %STROSS_TOKEN%
                        """
                    }
                }
            }       
        }
    }
}

方式2：通过环境变量传递Token #

pipeline {
    agent {
        node {
            label 'node1'
        }
    }
    stages {
        stage('running python script') {
            steps {
                withCredentials([string(credentialsId: 'devadrita-stross', variable: 'STROSS_TOKEN')]) {
                    script {
                        bat """
                        set STROSS_TOKEN=%STROSS_TOKEN%
                        python -u C://Users//Administrator//Desktop//stross//stross-script.py
                        """
                    }
                }
            }       
        }
    }
}

2. 对应修改的Python脚本 #

方式1：接收命令行参数的Python脚本 #

import requests
import urllib3
import json
import time
import os
import sys

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def initiateScan(token):
    url = ""

    payload={}
    files=[
    ('source',('amail.zip',open('C:/Users/Administrator/Desktop/stross/amail.zip','rb'),'application/zip')),
    ('metadata',('metadata.json',open('C:/Users/Administrator/Desktop/stross/metadata.json','rb'),'application/json'))
    ]
    headers = {
    'Authorization': f'Bearer {token}'
    }

    response = requests.request("POST", url, headers=headers, data=payload, files=files, verify=False)

    resp=response.json()
    print(resp)
    
    jobId=resp["job_id"]
    return(jobId)
    
def main():
    if len(sys.argv) < 2:
        print("错误：未传入Token参数")
        sys.exit(1)
    token = sys.argv[1]
    jobIdFromInitiate=initiateScan(token)

if __name__ == "__main__":
    main()

方式2：读取环境变量的Python脚本 #

import requests
import urllib3
import json
import time
import os
import sys

urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)

def initiateScan(token):
    url = ""

    payload={}
    files=[
    ('source',('amail.zip',open('C:/Users/Administrator/Desktop/stross/amail.zip','rb'),'application/zip')),
    ('metadata',('metadata.json',open('C:/Users/Administrator/Desktop/stross/metadata.json','rb'),'application/json'))
    ]
    headers = {
    'Authorization': f'Bearer {token}'
    }

    response = requests.request("POST", url, headers=headers, data=payload, files=files, verify=False)

    resp=response.json()
    print(resp)
    
    jobId=resp["job_id"]
    return(jobId)
    
def main():
    token = os.getenv('STROSS_TOKEN')
    if not token:
        print("错误：未找到STROSS_TOKEN环境变量")
        sys.exit(1)
    jobIdFromInitiate=initiateScan(token)

if __name__ == "__main__":
    main()

疑问解答 #

1. 你之前的withCredentials块位置错误，它必须放在steps或script这类可执行步骤范围内，否则Jenkins会报错，参考上面的正确代码结构即可。
2. “将凭证绑定到环境变量”是指Jenkins把凭证管理器中的Token值，临时赋值给指定的环境变量，仅在withCredentials块的范围内可用。withCredentials([string(...)])里的variable参数就是环境变量名，比如示例中的STROSS_TOKEN。你原来的environment块和withCredentials功能重复，推荐只用withCredentials，它的作用范围更可控，避免凭证泄露到整个流水线环境。
3. 传递Token到Python脚本有两种常用方式：
   • 命令行参数：在Jenkins的bat命令中把环境变量作为参数传给脚本，Python用sys.argv接收。
   • 环境变量：在bat命令中先将Jenkins的临时环境变量设置为系统环境变量（Windows用set），Python用os.getenv读取。

内容的提问来源于stack exchange，提问作者Devadrita Bose