How do you structure a Jenkins pipeline safely?

A Jenkinsfile makes the pipeline reviewable and versioned with the code. Declarative syntax gives structure through pipeline, agent, stages and post blocks, while scripted blocks handle logic that the declarative model does not cover cleanly.

• Keep jobs on agents, not on the controller
• Use ephemeral or containerized agents so builds do not contaminate each other
• Bind credentials with the credentials helper instead of echoing them
• Put shared logic in a reviewed shared library rather than copy-pasting pipelines
• Pin and update plugins deliberately because they are part of the attack surface
• Archive artifacts and publish test results for traceability

pipeline {
  agent any
  stages {
    stage('Test') {
      steps {
        sh 'npm ci'
        sh 'npm test'
      }
      post {
        always {
          junit 'reports/**/*.xml'
        }
      }
    }
  }
}