Add nonStoredPassword symbol for Pipeline syntax

[niklucas]

The @symbol annotation allows Jenkins Pipeline DSL to reference extensions using a short, memorable name rather than the full class name. This allows easy access to set parameter values in declarative syntax without having to use the full class name.

Problem:

It's not possible to declare the class via the simple parameters syntax in DSL:

10:25:48  Library curriculum-jenkins-library@test successfully cached.
10:25:48  [Pipeline] Start of Pipeline
10:25:49  [Pipeline] End of Pipeline
10:25:49  Also:   org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 2c155765-b134-474e-b131-7f4da304a4dd
10:25:49  Also:   org.jenkinsci.plugins.workflow.actions.ErrorAction$ErrorId: 2c155765-b134-474e-b131-7f4da304a4dd
10:25:49  org.jenkinsci.plugins.workflow.cps.CpsCompilationErrorsException: startup failed:
10:25:49  /var/lib/jenkins/jobs/Library/jobs/13/libs/f486e69665525f717055921d8bb70c1a3309ae0625efc0ba5cc2d8e5ba4ba64d/vars/test.groovy: 70: Build parameters cannot be defined as maps @ line 70, column 13.
10:25:49                 [$class: 'PasswordParameterDefinition', name: 'token', description: 'Token value']
10:25:49                 ^
10:25:49  
10:25:49  1 error

Trying to use the DSL syntax showed that we didn't have a short name available:
/var/lib/jenkins/jobs/Library/jobs/11/libs/f486e69665525f717055921d8bb70c1a3309ae0625efc0ba5cc2d8e5ba4ba64d/vars/test.groovy: 70: Invalid parameter type "nonStoredPassword". Valid parameter types: [activeChoice, reactiveChoice, activeChoiceHtml, base64File, booleanParam, buildSelector, choice, credentials, extendedChoice, file, gitParameter, jiraIssue, jiraReleaseVersion, listGitBranches, text, password, run, stashedFile, string] @ line 70, column 13.
10:00:58 nonStoredPassword(name: 'token', description: 'Token value')
10:00:58 ^
10:00:58
10:00:58 1 error

Change

Simply imports Symbol and adds @symbol with a short name for use on the class.

Testing done

Built the plugin locally.
Loaded the locally built plugin to Jenkins UI
Ran a test pipeline with nonStoredPassword(name: 'token', description: 'Token value') in parameters {}
Confirmed that build worked successfully and supplied the password appropriately. (i.e. I no longer got the above error messages which prevented the pipeline from even starting):

[2025-10-16T14:58:48.298Z]  > git config core.sparsecheckout # timeout=10
[2025-10-16T14:58:48.302Z]  > git checkout -f 3bfe16e641173915165208be6f2745133e910da1 # timeout=10
[2025-10-16T14:58:48.312Z] Commit message: "Try updated plugin"
[2025-10-16T14:58:48.332Z] Library curriculum-jenkins-library@test successfully cached.
[2025-10-16T14:58:48.368Z] [Pipeline] Start of Pipeline
[2025-10-16T14:58:50.336Z] [Pipeline] node
[2025-10-16T14:58:50.350Z] Running on Jenkins in /var/lib/jenkins/workspace/test
[2025-10-16T14:58:50.526Z] [Pipeline] {
[2025-10-16T14:58:50.568Z] [Pipeline] stage
[2025-10-16T14:58:50.574Z] [Pipeline] { (Initialize)

Also confirmed that the UI automatically set the Non Stored Password parameter for future builds of that pipeline:

Submitter checklist

• Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• Ensure that the pull request title represents the desired changelog entry
• Please describe what you did
• Ensure you have provided tests that demonstrate the feature works or the issue is fixed

[MarkEWaite]

Thanks for the addition. Please provide tests that confirm the newly added symbol works as expected in declarative Pipeline and scripted Pipeline.

[niklucas]

Please provide at tests that confirm the newly added symbol works as expected in declarative Pipeline and scripted Pipeline.

Can you expand on what you'd like to see exactly outside of what I've provided?

[MarkEWaite]

Can you expand on what you'd like to see exactly outside of what I've provided?

Sure.

I'd like to see a test that refers to the new symbol in a sample declarative Pipeline and confirms that the sample declarative Pipeline runs successfully twice. The first run defines the parameter for the job and the second run accepts the parameter. Examples of that type of test are available at:

• https://github.com/jenkinsci/priority-sorter-plugin/blob/master/src/test/java/jenkins/advancedqueue/test/DeclarativePipelineTest.java
• https://github.com/jenkinsci/gitlab-plugin/blob/master/src/test/java/com/dabsquared/gitlabjenkins/workflow/GitLabCommitStatusStepTest.java
• https://github.com/jenkinsci/gitlab-plugin/blob/master/src/test/java/com/dabsquared/gitlabjenkins/workflow/GitLabMergeRequestLabelExistsStepTest.java

I'd like a test that refers to the new symbol in a sample scripted Pipeline and confirms that the sample scripted Pipeline runs successfully twice. The first run defines the parameter for the job and the second run accepts the parameter. An example of that type of test is available at:

• https://github.com/jenkinsci/gitlab-plugin/blob/master/src/test/java/com/dabsquared/gitlabjenkins/connection/GitLabApiTokenBindingTest.java

[niklucas]

I added a DeclarativePipelineTest.java.

To be honest, I struggled with the scripted side. Perhaps this is something that I'm not understanding correctly, but the purpose of using Symbol is to create an alias that works with the declarative syntax so that you aren't forced into using a scripted approach to the parameters instead.

I did do this (but didn't merge it here): https://github.com/niklucas/mask-passwords-plugin-symbol/blob/scripted-test/src/test/java/com/michelin/cio/hudson/plugins/passwordparam/ScriptedPipelineTest.java but I can't really use nonStoredPassword() from @symbol instead of the [$class: 'PasswordParameterDefinition',.... So I'm not sure what that would do for proving much about this test other than that Symbol doesn't impact the scripted pipeline (but it kind of feels like all of the other test instances continuing to work did that too?). Perhaps you have some ideas on how this might be implemented from another angle.

[MarkEWaite]

I did do this (but didn't merge it here): https://github.com/niklucas/mask-passwords-plugin-symbol/blob/scripted-test/src/test/java/com/michelin/cio/hudson/plugins/passwordparam/ScriptedPipelineTest.java but I can't really use nonStoredPassword() from @symbol instead of the [$class: 'PasswordParameterDefinition',....

I think you may have a syntax error in your scripted Pipeline. The following worked for me:

node {
    properties([parameters([nonStoredPassword(description: 'Enter a password', name: 'A_PASSWORD')])])
    stage('Results') {
        echo "Parameter is ${params.A_PASSWORD} or ${A_PASSWORD}"
    }
}

Please also include documentation in the README that describes why someone would use a non-stored password and how it is different from other uses.

[niklucas]

Thanks! I've updated both to add the scripted test and the README.

[MarkEWaite]

The change looks good to me. I've made changes that allow the tests to pass on my local development environment.

[ramapalani]

Can I be removed from this github repo's admin, I'm not contributing to this anymore

…

On Thu, Oct 23, 2025 at 7:20 PM Mark Waite ***@***.***> wrote: ***@***.**** approved this pull request. The change looks good to me. I've made changes that allow the tests to pass on my local development environment. — Reply to this email directly, view it on GitHub <#102 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABV4VKTURSDTBNBOCYD7U4L3ZGEFDAVCNFSM6AAAAACJMGVVBCVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTGNZUGAYTAOJQHE> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.*** com>

[MarkEWaite]

Can I be removed from this github repo's admin, I'm not contributing to this anymore
…
On Thu, Oct 23, 2025 at 7:20 PM Mark Waite @.> wrote: @.* approved this pull request. The change looks good to me. I've made changes that allow the tests to pass on my local development environment. — Reply to this email directly, view it on GitHub <#102 (review)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ABV4VKTURSDTBNBOCYD7U4L3ZGEFDAVCNFSM6AAAAACJMGVVBCVHI2DSMVQWIX3LMV43YUDVNRWFEZLROVSXG5CSMV3GSZLXHMZTGNZUGAYTAOJQHE . You are receiving this because you are subscribed to this thread.Message ID: @.*** com>

I don't see any indication that you are an administrator of this repository. Can you explain why you believe you are an administrator of this repository?