Environment variables access in Jenkins - Commands & Configuration

Introduction

Environment variables store important information like passwords or settings outside your code. Accessing them in Jenkins helps keep your builds safe and flexible without hardcoding sensitive data.

When you want to keep passwords or API keys secret in your Jenkins jobs.

When you need to reuse the same configuration values across multiple build steps.

When you want to change settings without editing the Jenkins pipeline code.

When you want to pass system or custom values to your build scripts.

When you want to debug or log environment information during a build.

Config File - Jenkinsfile

Jenkinsfile

pipeline {
  agent any
  environment {
    MY_SECRET = 's3cr3tValue'
    APP_ENV = 'production'
  }
  stages {
    stage('Show Env') {
      steps {
        echo "The secret is ${MY_SECRET}"
        echo "Running in environment: ${APP_ENV}"
      }
    }
  }
}

The environment block defines variables accessible in all stages.

Here, MY_SECRET and APP_ENV are set and used inside the echo steps to print their values.

Commands

Check that Jenkins CLI or job builder is installed and accessible before running pipelines.

Terminal

jenkins-jobs --version

Expected Output

1.0.0

Trigger the Jenkins pipeline named 'example-pipeline' and wait for it to finish, so you can see the output including environment variable usage.

Terminal

jenkins-cli build example-pipeline -s

Expected Output

[Pipeline] echo

The secret is s3cr3tValue

[Pipeline] echo

Running in environment: production

Finished: SUCCESS

→

-s - Waits for the build to complete and shows the console output.

View the console output of the last run of 'example-pipeline' to verify environment variables were accessed correctly.

Terminal

jenkins-cli console example-pipeline

Expected Output

[Pipeline] echo

The secret is s3cr3tValue

[Pipeline] echo

Running in environment: production

Finished: SUCCESS

Key Concept

If you remember nothing else from this pattern, remember: define environment variables in the Jenkinsfile's environment block to safely and easily access them in all pipeline steps.

Common Mistakes

Trying to access environment variables without defining them in the environment block or system settings.

The variables won't exist during the build, causing errors or empty values.

Always define environment variables in the Jenkinsfile environment block or configure them in Jenkins global or job-specific settings.

Hardcoding secrets directly in pipeline steps instead of using environment variables.

This exposes sensitive data in the code and logs, risking security.

Use environment variables or Jenkins credentials plugin to keep secrets safe and separate from code.

Summary

Define environment variables in the Jenkinsfile environment block for easy access.

Use echo steps to print and verify environment variable values during builds.

Trigger and check pipeline runs using Jenkins CLI commands to see environment variable usage.

Practice

1. In a Jenkins Pipeline script, how do you access an environment variable named BUILD_NUMBER?

easy

A. Using BUILD_NUMBER directly without prefix

B. Using env.BUILD_NUMBER

C. Using getEnv('BUILD_NUMBER')

D. Using $BUILD_NUMBER inside the script block

Solution

1. Step 1: Understand Jenkins environment variable access

   Jenkins Pipeline exposes environment variables via the env object.

2. Step 2: Access the variable using the correct syntax

   You access BUILD_NUMBER as env.BUILD_NUMBER in the script.

3. Final Answer:

   Using env.BUILD_NUMBER -> Option B

4. Quick Check:

   env.VARIABLE_NAME = correct access [OK]

Hint: Always prefix environment variables with env. in Jenkins [OK]

Common Mistakes:

• Trying to use variable name without env prefix
• Using shell-style $VARIABLE inside Groovy script
• Calling non-existent getEnv() method

2. Which of the following is the correct syntax to print the environment variable JOB_NAME in a Jenkins Pipeline script block?

easy

A. println("JOB_NAME")

B. echo $JOB_NAME

C. println(env.JOB_NAME)

D. print(JOB_NAME)

Solution

1. Step 1: Identify the correct way to print env variables in Groovy script

   In Jenkins Pipeline Groovy scripts, use println(env.VARIABLE) to print environment variables.

2. Step 2: Check each option

   println("JOB_NAME") prints the string "JOB_NAME" literally. echo $JOB_NAME uses shell syntax, invalid in Groovy. print(JOB_NAME) attempts to print JOB_NAME directly, but it's not available in Groovy scope without env prefix.

3. Final Answer:

   println(env.JOB_NAME) -> Option C

4. Quick Check:

   Use println(env.VARIABLE) to print env vars in script [OK]

Hint: Use println(env.VARIABLE) inside script blocks [OK]

Common Mistakes:

• Using shell syntax like $VARIABLE inside Groovy
• Printing variable name as string instead of value
• Trying to access variables without env. prefix

3. Given this Jenkins Pipeline snippet:

pipeline {
  agent any
  stages {
    stage('Print Env') {
      steps {
        script {
          echo "Branch is: ${env.BRANCH_NAME}"
        }
      }
    }
  }
}

What will be the output if the environment variable BRANCH_NAME is set to feature-123?

medium

A. Branch is: feature-123

B. Branch is: ${env.BRANCH_NAME}

C. Branch is: BRANCH_NAME

D. Error: BRANCH_NAME not found

Solution

1. Step 1: Understand string interpolation in Jenkins Pipeline

   Using double quotes with ${env.BRANCH_NAME} interpolates the variable value.

2. Step 2: Substitute the environment variable value

   Since BRANCH_NAME is set to "feature-123", the output will be "Branch is: feature-123".

3. Final Answer:

   Branch is: feature-123 -> Option A

4. Quick Check:

   Double quotes + ${env.VAR} = variable value [OK]

Hint: Use double quotes and ${env.VAR} for variable interpolation [OK]

Common Mistakes:

• Using single quotes which prevent interpolation
• Printing variable name literally without ${}
• Assuming env variables are undefined

4. You wrote this Jenkins Pipeline snippet:

pipeline {
  agent any
  environment {
    MY_VAR = 'hello'
  }
  stages {
    stage('Test') {
      steps {
        script {
          echo env.MY_VAR
        }
      }
    }
  }
}

But the output is empty. What is the likely cause?

medium

A. The environment block syntax is incorrect; use MY_VAR='hello' with quotes and no spaces around =

B. Environment variables must be accessed as env['MY_VAR'] not env.MY_VAR

C. The environment variable was not set correctly; use MY_VAR='hello' without spaces

D. You cannot access environment variables inside script blocks

Solution

1. Step 1: Check environment block syntax

   In Jenkins Pipeline, environment variables must be assigned with no spaces around = and values in quotes, like MY_VAR='hello'.

2. Step 2: Identify the syntax error in the snippet

   The snippet uses MY_VAR = 'hello' with spaces around = which is invalid and causes the variable not to be set.

3. Final Answer:

   The environment block syntax is incorrect; use MY_VAR='hello' with quotes and no spaces around = -> Option A

4. Quick Check:

   Use no spaces around = in environment block [OK]

Hint: No spaces around = in environment block assignments [OK]

Common Mistakes:

• Adding spaces around = in environment variable assignment
• Trying to access env vars incorrectly
• Assuming script block can't access env vars

5. You want to pass a secret API key stored as an environment variable API_KEY to a shell command in Jenkins Pipeline. Which is the best way to do this securely?

hard

A. Use sh "curl -H 'Authorization: Bearer $API_KEY' https://api.example.com"

B. Use sh(script: "curl -H 'Authorization: Bearer ${env.API_KEY}' https://api.example.com")

C. Use sh(script: "curl -H 'Authorization: Bearer $API_KEY' https://api.example.com", environment: [API_KEY: env.API_KEY])

D. Use Jenkins credentials binding plugin to inject API_KEY and access it as env.API_KEY inside sh

Solution

1. Step 1: Understand secure handling of secrets in Jenkins

   Secrets like API keys should be stored in Jenkins credentials and injected securely, not hardcoded or exposed in logs.

2. Step 2: Use credentials binding plugin

   This plugin injects secrets as environment variables during the build, accessible as env.API_KEY inside sh without exposing them in logs.

3. Final Answer:

   Use Jenkins credentials binding plugin to inject API_KEY and access it as env.API_KEY inside sh -> Option D

4. Quick Check:

   Use credentials plugin for secrets, not plain env vars [OK]

Hint: Use Jenkins credentials plugin for secrets, not plain env vars [OK]

Common Mistakes:

• Passing secrets directly in shell commands risking exposure
• Using string interpolation exposing secrets in logs
• Not using Jenkins credentials plugin for sensitive data