18.v7f17b_86cf4b_8

First Jenkins-hosted release: 18.v7f17b_86cf4b_8

The plugin is now maintained in jenkinsci/awarely-scan-plugin and uses the official Jenkins release workflow and version format. The plugin ID remains awarely-scan; existing installations can upgrade normally.

This release includes the hosting-review fixes after historical 0.2.0: POST/CSRF protection for credential selection, explicit ADMINISTER authority, proxy-aware bounded CLI downloads on the controller, compatible enum-backed configuration, documented controller-restart behavior and immediate persistence for global setters with one save per configuration form. The CLI remains v0.12.0 with managed Syft 1.54.1. Follow the English/Romanian guides for the distinct controller and agent network requirements.

The six earlier GitHub releases remain downloadable with their original provenance and checksums. They are historical artifacts, not newly built Jenkins releases.

Published through the official Jenkins CD workflow. The HPI and checksums are in Jenkins Maven, rather than attached to this GitHub release. Update Center and plugin-site indexing may follow later.

This version uses the Jenkins-generated format 18.v7f17b_86cf4b_8; it supersedes historical 0.2.0 and keeps the same plugin ID. The exact release commit passed all 62 tests in Jenkins CI and Jenkins Security Scan.

🚀 New features and improvements

• Prepare official Jenkins publication and preserve historical releases (#2) @awarelyeu

🐛 Bug fixes

• Persist global configuration setters and batch form saves (#1) @awarelyeu

Awarely Scan for Jenkins v0.2.0

Historical release, originally published on 2026-10-13 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.2.0. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Awarely Scan for Jenkins 0.2.0

NuGet/.NET libraries and Go modules now support Monitor CVE checks through the existing Syft collector. The plugin pins CLI v0.12.0 and managed Syft 1.54.1. The collector label and help explain the preparation required, supported assessment and remaining coverage gaps.

NuGet and Go findings use the existing per-component version precision, severity gate, incomplete-assessment policy and build comparison. Backend checks require exact ecosystem/package identity and ecosystem-specific version ordering. Unknown versions and advisory syntax remain visible; Go toolchain/stdlib assessment is outside this module check. Job permissions, credential isolation, source ownership and tool verification remain enforced.

English walkthrough · Ghid în română · Verify the release

This is a stable GitHub HPI release. Jenkins Update Center publication remains pending community hosting approval.

Awarely Scan for Jenkins v0.1.0

Historical release, originally published on 2026-10-13 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.1.0. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Awarely Scan for Jenkins 0.1.0

First stable GitHub release, promoting the runtime tested in 0.1.0-alpha.5. CLI v0.11.0 and managed Syft 1.54.1 remain pinned; collector behavior, permissions, policy and synchronization semantics are unchanged.

Available workflows

• Pipeline and Freestyle inventory for npm, Python, Java, Linux agent packages, other Syft ecosystems, and existing/imported SBOMs.
• Local CycloneDX export, explicit Monitor CVE checks, or synchronization of one configured source.
• Configuration preflight, readable console progress, optional bounded detailed logging, complete JSON artifacts, and comparison with compatible previous builds.
• Version-confirmed severity policies with report-only, UNSTABLE or FAILURE outcomes; incomplete assessment coverage remains explicit.
• Administrator job/node/origin approvals, private tool/results directories, verified pinned downloads, and one trusted writer job per synchronized source.

Validation and installation

Manual acceptance covered Pipeline/Freestyle, Linux amd64/arm64 agents, baseline and updated applications, policy outcomes and deployment gating, synchronization, and denied job/scope/path/partial-inventory/competing-writer cases. Remote acceptance used an isolated staging tenant and clearly identified synthetic CVE fixtures. These tests do not imply that a successful check proves an application secure.

Release CI rebuilds and tests the plugin on Linux amd64 and arm64, validates artifact versions and CLI pins, and publishes provenance attestations for the HPI, dependency SBOM and checksums. Release refs must target a GitHub-verified commit; unsigned annotated tags are rejected. Published versions are never replaced.

Requires Jenkins 2.580.1+, JDK 21 on the tested baseline, and isolated non-root Linux amd64/arm64 agents. Verify the HPI, back up your controller and validate your setup on staging before upgrading. Existing alpha installations keep the same awarely-scan plugin ID.

Distribution: this stable release is available as a manually installed HPI on GitHub. Jenkins project hosting and Update Center publication are pending; this release does not claim Jenkins project approval.

Download and verification · English walkthrough · Ghid în română

Awarely Scan for Jenkins v0.1.0-alpha.5

Historical release, originally published on 2026-10-13 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.1.0-alpha.5. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Clear console progress and safe diagnostics

Pipeline and Freestyle builds now explain input validation, tool preparation, collection, inventory coverage, API operations, policy decisions, report locations and elapsed time. Normal logs stay concise; enable Detailed logging or detailedLogging: true for additional cache-verification details.

Expected input errors, including malformed inventories and paths that escape the workspace, stop the build with actionable messages instead of Java stack traces. Known API refusals explain the relevant recovery step. Only fixed diagnostic codes are accepted from the CLI; raw subprocess output, HTTP bodies and credentials are not forwarded to the Jenkins console.

This preview pins Awarely Scan v0.11.0, including its authenticated diagnostic catalog, and retains managed Syft 1.54.1. Job approvals, credential isolation, synchronization protection, coverage rules and build policies are unchanged. The bundled shield-and-A sidebar icon remains available.

Validated by the plugin test suite on Linux amd64 and arm64, Jenkins Security Scan and release provenance checks. The published HPI also passed 12 isolated Jenkins acceptance cases (including expected refusals), default logging on amd64, detailed logging on arm64, Freestyle/preflight, source synchronization and authenticated UI checks. Synthetic staging fixtures were used; these are functional checks, not a production vulnerability verdict. English and Romanian guides include the new logging options.

Requires Jenkins 2.580.1 or newer, JDK 21 on the tested baseline, and dedicated non-root Linux amd64/arm64 agents. This is a GitHub preview HPI; it is not yet a Jenkins Update Center release.

English walkthrough · Ghid în română · Verify the release · CLI v0.11.0

Awarely Scan for Jenkins v0.1.0-alpha.4

Historical release, originally published on 2026-10-13 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.1.0-alpha.4. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Awarely Scan for Jenkins 0.1.0-alpha.4

The build sidebar now shows Awarely Scan with a bundled shield-and-A icon. The previous icon referenced an unavailable Jenkins symbol and displayed a fallback X. The new SVG follows the Jenkins theme, works offline and adds no plugin dependency.

This is a presentation-only correction to alpha.3. Inventory collection, API checks, synchronization, preflight, build policies and build comparison behavior are unchanged. The pinned CLI remains v0.10.1, with managed Syft 1.54.1. English and Romanian guides identify the sidebar icon and link to the updated preview.

Requires Jenkins 2.580.1 or newer, JDK 21 on the tested baseline, and isolated non-root Linux amd64/arm64 agents. This is a GitHub preview HPI, not a Jenkins Update Center release. Verify its public provenance and checksum and test on staging before production use.

English walkthrough · Ghid în română · Release verification

Awarely Scan for Jenkins v0.1.0-alpha.3

Historical release, originally published on 2026-10-11 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.1.0-alpha.3. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Awarely Scan for Jenkins 0.1.0-alpha.3

This preview makes setup and build outcomes explicit:

• Validate configuration only checks the actual agent, paths, private output permissions, CLI cache/download policy, administrator approvals and credential format without running a scan, downloading tools or contacting Monitor. Pending downloads and untested Syft/API readiness are stated clearly. Field help includes concrete examples and recovery steps.
• Choose UNSTABLE or FAILURE for severity and incomplete-coverage policies. UNSTABLE remains the default for existing jobs. FAILURE preserves evidence and stops normal step execution; deliberate Pipeline error handling still applies.
• Changes since the previous build shows components added/removed and observed CVE-match differences from retained full reports. Scope/destination compatibility, completed baselines and coverage are required; changed catalog dates are disclosed. Missing data is not reported as remediation.

English and Romanian walkthroughs cover installation, preflight, Pipeline/Freestyle configuration, build policies and comparison limitations. The fixed CLI is updated to v0.10.1, built with Go 1.27.2 security fixes; managed Syft remains 1.54.1. Tool verification, scoped credentials, separate host/sync approvals and sync ordering protections remain in place.

Requires Jenkins 2.580.1 or newer, JDK 21 on the tested baseline, and isolated non-root Linux amd64/arm64 agents. This is a GitHub preview HPI, not a Jenkins Update Center release. Verify its public provenance and checksum and test on staging before production use.

English walkthrough · Ghid în română · Release verification

Awarely Scan for Jenkins v0.1.0-alpha.2

Historical release, originally published on 2026-10-09 from awarelyeu/awarely-scan-plugin. Mirrored here after Jenkins hosting approval. All assets are byte-for-byte copies; their original provenance identity remains awarelyeu/awarely-scan-plugin and .github/workflows/preview-release.yml@refs/tags/v0.1.0-alpha.2. This historical HPI is not a Jenkins Update Center release. See the current installation guide and historical verification instructions.

---

Awarely Scan for Jenkins 0.1.0-alpha.2

This preview is built and published from the dedicated awarelyeu/awarely-scan-plugin repository, with updated repository metadata, CI actions and English/Romanian installation guides. The HPI, dependency SBOM and checksums have public provenance attestations tied to this repository and release tag. The plugin runtime source and fixed CLI/Syft versions are unchanged from 0.1.0-alpha.1.

Collect an application SBOM during a build, check it against Awarely Monitor and explicitly synchronize a configured source after deployment. The plugin supports Linux agents, native npm/Python manifests, managed Syft for npm/Python/Java/other ecosystems, external CycloneDX application imports and existing Awarely inventories.

Pipeline and Freestyle jobs share the same CLI, private outputs, credential handling and reports. Administrators approve exact jobs, agent nodes and API origins; synchronization and Linux host inventory require separate approval. Severity gates use version-confirmed matches; partial inventories and unevaluated components have an independent policy. API failures remain failures and preserve the local SBOM.

Jenkins 2.580.1 or newer and Linux amd64/arm64 agents are required. JDK 21 is the tested runtime. Use isolated agents for trusted jobs. This preview is distributed as a provenance-attested HPI in this repository, not through the Jenkins Update Center. Verify the artifact before installation.

English walkthrough · Ghid în română · Release verification