Is it possible to share pipeline definitions in shared libraries and use these definitions in multibranch pipeline jobs?
We're trying to build a conventional declarative pipeline for all of our repositories to share. Each repository would essentially have the same Jenkinsfile. As such, we've created a shared pipeline step that's basically just conventionalPipeline, so each repository's Jenkinsfile would be a single line to call this step.
This idea is stopped dead in its tracks with RejectedAccessExceptions because multibranch pipeline projects run in the sandbox (there's no way to prevent the sandbox). This issue tracks the behavior within the Jenkins project.
We can trust conventionalPipeline and everything it does, but because it calls untrusted methods we can't call it within multibranch pipelines. We could whitelist all the methods it calls, but this would open up the security holes that the sandbox tries to close.
There are two options I see - curious if I've overlooked something
Modify jenkins somehow to allow an untrusted method to become trusted and allow all subsequent method calls by that method to be implicitly trusted
Allow multibranch pipeline definitions to be defined in the jenkins config for the repository rather than in SCM, and let this job run outside the sandbox
Would appreciate any guidance.