ci-cd-jenkins-rails

Jenkins for Rails

Jenkins is the right answer when corporate / regulatory rules forbid managed CI (some banks, defense, healthcare). For everyone else: GitHub Actions or GitLab CI is faster to set up, better-maintained, and has fewer footguns. This skill shows the minimum viable Jenkinsfile and the trade-offs.

The opinion

If you can use GitHub Actions or GitLab CI: do that instead. Jenkins ROI is poor in 2026 — plugin sprawl, fragile upgrades, Groovy security debt, slow runners by default. If you MUST use Jenkins (regulatory / on-prem constraint), use Declarative Pipelines (not Freestyle, not Scripted), one Jenkinsfile per repo, run agents in Docker, store secrets in the Credentials store (NEVER environment variables), upgrade Jenkins LTS quarterly.

When Jenkins is unavoidable

• Air-gapped or strictly on-prem with no managed CI option.
• Heavy compliance environment (some FedRAMP, DoD, certain banks) that won't approve cloud-hosted CI.
• Existing Jenkins fleet you have to integrate with (migration to GHA/GitLab over multiple quarters).

Outside those constraints, the maintenance overhead is hard to justify.

Pattern 1: Declarative pipeline (the modern default)

// Jenkinsfile
pipeline {
  agent {
    docker {
      image 'ruby:3.3'
      args  '-v $HOME/.bundle:/usr/local/bundle'
    }
  }

  options {
    timeout(time: 30, unit: 'MINUTES')
    timestamps()
    buildDiscarder(logRotator(numToKeepStr: '30'))
    disableConcurrentBuilds()
  }

  environment {
    RAILS_ENV   = 'test'
    BUNDLE_PATH = 'vendor/bundle'
    IMAGE       = 'registry.example.com/myorg/myapp'
  }

  stages {
    stage('Setup') {
      steps {
        sh 'bundle install --jobs 4'
        sh 'yarn install --frozen-lockfile'
        sh 'bin/rails db:prepare'
      }
    }

    stage('Test') {
      parallel {
        stage('RSpec') {
          steps {
            sh 'bundle exec rspec --format progress --format RspecJunitFormatter --out tmp/rspec.xml'
          }
          post {
            always { junit 'tmp/rspec.xml' }
          }
        }

        stage('RuboCop') {
          steps { sh 'bundle exec rubocop --parallel' }
        }

        stage('Brakeman') {
          steps { sh 'bundle exec brakeman -q --no-pager' }
        }

        stage('bundle-audit') {
          steps { sh 'bundle exec bundle-audit check --update' }
        }
      }
    }

    stage('Build image') {
      when { branch 'main' }
      steps {
        sh 'docker build -t ${IMAGE}:${BUILD_NUMBER} .'
        sh 'docker push ${IMAGE}:${BUILD_NUMBER}'
      }
    }

    stage('Deploy') {
      when { branch 'main' }
      // `input` holds the agent for the entire wait. For long approvals, set
      // `agent none` on this stage and allocate the executor in a nested `node` block
      // after the input resolves so you don't starve the pool.
      input { message 'Deploy to production?'; ok 'Deploy' }
      steps {
        withCredentials([sshUserPrivateKey(credentialsId: 'kamal-deploy', keyFileVariable: 'KAMAL_SSH_KEY')]) {
          sh '''
            eval $(ssh-agent -s)
            ssh-add $KAMAL_SSH_KEY
            bundle exec kamal deploy
          '''
        }
      }
    }
  }

  post {
    failure {
      slackSend channel: '#engineering', color: 'danger',
        message: "Build ${env.JOB_NAME} #${env.BUILD_NUMBER} failed: ${env.BUILD_URL}"
    }
  }
}