Package io.jenkins.plugins.changeinvestigator.security

Class ChangeInvestigatorPermissions

java.lang.Object
io.jenkins.plugins.changeinvestigator.security.ChangeInvestigatorPermissions
public final class ChangeInvestigatorPermissions extends Object
Permissions specific to this plugin. Viewing an investigation is already gated by the standard Item.READ permission (Jenkins denies access to the whole build subtree, including any attached actions, without it). Triggering a new AI call is a distinct, resource-consuming action, so it is gated by its own permission that composes into the existing job permission matrix.

  • Field Details

    • RUN_AI_ANALYSIS

      public static final Permission RUN_AI_ANALYSIS
      Permission required to (re-)run the AI assessment for a build. This is deliberately not implied by Item.BUILD (or any other job-level permission) - being trusted to trigger builds does not, by itself, authorize spending AI provider budget. It must be granted explicitly by an administrator in the permission matrix.

      It is implied by Jenkins.ADMINISTER, matching normal Jenkins semantics: an instance administrator already has effective access to everything and does not need a separate, redundant grant for every plugin-specific permission.

      Scoped to PermissionScope.RUN (with group Run.PERMISSIONS), matching how Jenkins core itself scopes per-build permissions like Run.DELETE and Run.UPDATE: this permission only ever governs an action taken against a specific build, never the job/item as a whole. RUN is contained by ITEM (see PermissionScope), so it remains configurable anywhere an item-scoped permission would be - per-project and per-folder Matrix Authorization Strategy tables, as well as the global matrix - without changing where an administrator can grant it.