Circuit grade
jenkins: B
83% of the points that apply, read from conn3xorg/circuit-jenkins at v0.1.0 on 2 November 2026. That's a pass.This tells you what we checked. It doesn't tell you the circuit is safe, because no grade can: it runs as root on your servers, so read it before you run it.
Testing
| Check | Result | Points | What we saw |
|---|---|---|---|
| CI isn't staying red on main (must pass) | Passed | 15 of 15 | Run of 2026-11-02 passed. |
| Applied on real distributions in CI | Passed | 10 of 10 | 4 in the matrix: debian13, fedora45, rocky10, ubuntu2404. |
| A second plan comes back clean (must pass) | Passed | 15 of 15 | CI fails if a plan after apply shows changes. |
| CI uses the thing, past "service is active" (must pass) | Passed | 20 of 20 | Step "Log in with a crumb, check the plugin, restart and check again" runs: curl -sf -o /dev/null $u/login && break; sleep 1; done |
| CI checks secrets stay out of state | Failed | 0 of 10 | Has secret inputs, and CI never looks for them in state. |
| Restart or reboot tested | Passed | 5 of 5 | CI restarts it and checks again. |
| Upgrade tested | Failed | 0 of 5 | No CI step upgrades an existing install. |
| Recent run on a real host | Failed | 0 of 5 | No real-host workflow has passed. A README saying so doesn't count. |
Supply chain
| Check | Result | Points | What we saw |
|---|---|---|---|
| Downloads are checksummed | Passed | 5 of 5 | All 1 download steps have a checksum. |
| Container images pinned by digest | Doesn't apply | – | Pulls no images. |
| Pinned repo keys aren't near expiry | Passed | 5 of 5 | files/jenkins.asc expires on 2028-12-21. |
| Default listen address | Passed | 5 of 5 | Found no default or literal that listens on every address. |
| Privileged shell patterns | Passed | 5 of 5 | Found none of the listed patterns. |
Repository
| Check | Result | Points | What we saw |
|---|---|---|---|
| Release tag is signed | Passed | 5 of 5 | GitHub verified the signature on v0.1.0. |
| Main is protected | Passed | 5 of 5 | A ruleset requires pull requests and passing checks. |
| Released recently | Passed | 5 of 5 | v0.1.0 is 3 days old. |
How to read this
Every point comes from a CI file, a workflow run or a signature that a script read. A README can't earn one. So a pass here means CI ran what it says; a miss can mean the work was done and never written into CI, which we count the same way. The rubric lists every check, what it's worth and what it can't see.
The CI run we read is on GitHub, so you can check our reading.
Badge
[](https://conn3x.org/circuits/jenkins/grade)