Merge pull request #43 from SignPath/release/jenkins-plugin-3.3.0

adds changelog for Jenkins 3.3.0

Author: paulsavoie

docs/_data/changelog.yml

@@ -1,5 +1,20 @@
 - date: '2026-03-30'
   updates:
+    jenkins_plugin:
+      version: 3.3.0
+      breaking_changes:
+        - text: Requires Jenkins version 2.426.3 or higher.
+          issues: [SIGN-8114]
+      new_features:
+        - text: |-
+            The `archiveArtifact` step is not required any more for signing. Instead of the actual artifact, a digest file is now automatically published to the Jenkins server.
+          issues: [SIGN-8283]
+        - text: |-
+            Added the `inputArtifactRetrievalUrl` and `inputArtifactRetrievalHttpHeaders` parameters to allow retrieving an unsigned artifact from a HTTPS URL.
+          issues: [SIGN-8394]
+      improvements:
+        - text: Various performance improvements.
+          issues: [SIGN-8437]
     application:
       version: 1.208.1
       new_features:

docs/trusted-build-systems/jenkins.md

@@ -34,16 +34,6 @@ See the [official plugin page](https://plugins.jenkins.io/signpath/) on how the
 
 ## Usage
 
-In your `Jenkinsfile`, make sure the artifacts to be signed are pushed to the master node by adding a stage e.g.
-
-```scala
-    stage('Archive') {
-      steps {
-        archiveArtifacts artifacts: "build-output/**", fingerprint: true
-      }
-    }
-```
-
 ### Provided steps
 
 Include the `submitSigningRequest` and optionally, the `getSignedArtifact` steps in your build pipeline.
@@ -71,7 +61,9 @@ Include the `submitSigningRequest` and optionally, the `getSignedArtifact` steps
 | `inputArtifactPath`          | (mandatory)                               | Relative path of the artifact to be signed
 | `outputArtifactPath`         |                                           | Relative path where the signed artifact is stored after signing
 | `waitForCompletion`          | (mandatory)                               | Set to `true` for synchronous and `false` for asynchronous signing requests
-| `parameters`                 |                                           | [User-defined parameters](/artifact-configuration/syntax#parameters) as `Map<String, String>` key/value pairs 
+| `parameters`                 |                                           | [User-defined parameters](/artifact-configuration/syntax#parameters) as `Map<String, String>` key/value pairs
+| `inputArtifactRetrievalUrl`  |                                           | Can be used to retrieve the unsigned artifact from a HTTPS URL instead of uploading it from the agent. _Note: The file referenced via `inputArtifactPath` must be the same one._
+| `inputArtifactRetrievalHttpHeaders` |                                    | HTTP headers used for retrieving the artifact, as `Map<String, String>` key/value pairs.
 
 #### Parameters for the `getSignedArtifact` step
 
@@ -134,3 +126,24 @@ Include the `submitSigningRequest` and optionally, the `getSignedArtifact` steps
       }
     }
 ```
+
+#### Example: Submit a signing request, but download the unsigned artifact from a HTTPS URL
+
+```scala
+    stage('Sign with SignPath') {
+      steps {
+        submitSigningRequest(
+          projectSlug: "${PROJECT_SLUG}",
+          signingPolicySlug: "${SIGNING_POLICY_SLUG}",
+          artifactConfigurationSlug: "${ARTIFACT_CONFIGURATION_SLUG}",
+          inputArtifactPath: "build-output/my-artifact.exe",
+          outputArtifactPath: "build-output/my-artifact.signed.exe",
+          waitForCompletion: true,
+          inputArtifactRetrievalUrl: "https://my.download.share.com/my-artifact.exe",
+          inputArtifactRetrievalHttpHeaders: [
+            "Authorization": "Bearer mysupersecretauth"
+          ]
+        )
+      }
+    }
+```