[JENKINS-68280] Add ability to have the token be stored/defined from a Credential

[jenkins-infra-bot]

Goal here would be the ability to create a job with a root trigger token - but to tell jenkins that the value/content of that token is to be retrieved from a Credential. 

This could be any secret text/password type credential available in the system.

 

This would allow for direct coordination of job triggering/access with external secret handling/rotation/etc. mechanisms like Vault. 

---

Originally reported by nneul, imported from: Add ability to have the token be stored/defined from a Credential

• status: Open
• priority: Minor
• component(s): build-token-root-plugin
• resolution: Unresolved
• votes: 1
• watchers: 2
• imported: 20251215-193512

Raw content of original issue

Goal here would be the ability to create a job with a root trigger token - but to tell jenkins that the value/content of that token is to be retrieved from a Credential. 

This could be any secret text/password type credential available in the system.

 

This would allow for direct coordination of job triggering/access with external secret handling/rotation/etc. mechanisms like Vault. 

[jenkins-infra-bot]

kutzi:

• Original comment link
• Raw content of original comment:

  Would be really useful to have this, as in any environment where non-admin users can read job configs, they can see the build-token in plain-text.
  Which makes the approach of triggering builds by token not feasible in many environments, where more than basic security is needed.
  

Would be really useful to have this, as in any environment where non-admin users can read job configs, they can see the build-token in plain-text.
Which makes the approach of triggering builds by token not feasible in many environments, where more than basic security is needed.