timja / jenkins-gh-issues-poc-06-18

0 stars 0 forks source link

[JENKINS-27644] Ability to show server-driven Jenkins project notifications in the UI #7092

Open timja opened 9 years ago

timja commented 9 years ago

Background

Regardless of whether the ongoing Java version upgrade debate settles on Java 7 or Java 8, we should do as much as possible to advise users (as long as possible) in advance of the upcoming Java upgrade requirement.

Yes, people should ideally have a test environment and test every single Jenkins upgrade, so it's "their fault" if an upgrade goes bad, but we also have a diverse and large (100K!) userbase, plus a shiny "Upgrade automatically" button in the UI. So there will likely be a substantial number of people who will hit the button and complain loudly when Jenkins does not come up again due to an outdated JDK. There will also be people who upgrade automatically via a package manager (i.e. might not check the changelog on the website), or by downloading the WAR from the home page (but may not click through to the changelog).

Feature request

So, it would be nice if there was a way to notify users directly within the Jenkins UI.
We already show warnings on the Manage Jenkins page, based on the current state of the installation (e.g. outdated config files, broken reverse proxy, encryption re-key required).

But it would be nice to have messages that we can add (and remove) dynamically. For a Java upgrade warning, or for security advisories, for example.

This could be implemented by editing a JSON file that lives on updates.jenkins-ci.org (i.e. probably held in git and deployed by J-o-J) and gets fetched regularly by Jenkins, or by (somehow) adding another JSON object to the update-center.json.

It should be possible to make messages time-limited ("display until end of 2015-03-31"), and version-limited ("display if version >= 1.599 && version <= 1.606"). Optional extras could include a Java version restriction ("only show if JRE < 8"), a platform check ("only show on Windows"), or perhaps installation source ("only show for .rpm users" (not sure we can figure that out)). The Java check would be the most useful one just now.

Messages should be shown at the top on the Manage Jenkins page. It may be a nice addition if there was a "message type" field that allowed more urgent messages to be shown at the top of each page (similar to how "Jenkins is about to shut down" appears), though those should be dismissable (e.g. by storing a flag in a cookie).
Messages should probably be visible only to people with Jenkins#ADMINISTER permission. Or to everybody, if there is no authentication enabled (i.e. small installations, where it's probably fine to show this to all users).

So, as mentioned, I think this would be very useful for the Java upgrade scenario, i.e. show the message " Notice: Jenkins will soon require a modern Java version: see http://xxx." if "version < 1.XXX".

But this would also be generically useful in the future, e.g. for security advisories (like the really urgent ones this week), or for time-limited messages that should not be hardcoded into the WAR file and should preferably not require an upgrade to remove them (e.g. the "Jenkins 100K" sidebar link, the "1.387" background change etc.).


Originally reported by orrc, imported from: Ability to show server-driven Jenkins project notifications in the UI
  • status: Open
  • priority: Major
  • resolution: Unresolved
  • imported: 2022/01/10
timja commented 9 years ago

danielbeck:

It should be possible to make messages time-limited ("display until end of 2015-03-31")

Seems unnecessary, just change the message returned from jenkins-ci.org in time.

Messages should be shown at the top on the Manage Jenkins page.

I disagree. Should be shown on all pages for admins. Since the dropdown menus were introduced, I hardly ever visit /manage anymore. That's why I wrote https://github.com/daniel-beck/jenkins-visible-administrative-monitors-plugin


I think this is an awesome idea and definitely needed.

This should probably done mostly client-side (note like an admin monitor) to make it work on networks where Jenkins is not allowed to connect to the internet.

timja commented 9 years ago

orrc:

Great. Thanks for the feedback!

It should be possible to make messages time-limited ("display until end of 2015-03-31")

Seems unnecessary, just change the message returned from jenkins-ci.org in time.

Maybe, but it would be a nice-to-have. I know how reliable the Jenkins community is at remembering to do things on time...

Messages should be shown at the top on the Manage Jenkins page.

I disagree. Should be shown on all pages for admins.

Sure, that definitely sounds reasonable. I hadn't seen your plugin before; it makes sense.

This should probably done mostly client-side (note like an admin monitor) to make it work on networks where Jenkins is not allowed to connect to the internet.

I'm not sure I fully understand what you mean. I was thinking that Jenkins would periodically fetch the messages.json (or whatever) file, like it does with update-center.json. Jenkins would determine which notifications must be shown (if any) and would then render them to the page, for admin users. i.e. Most stuff happens server-side, though with some client-side JS to make notifications look nice / be dismissable.

If you don't ever allow Jenkins online, we can't really download timely notifications (like security advisories) from the server. Or do you mean that these messages should reach Jenkins via the browser-proxy method? Or something else?

timja commented 9 years ago

danielbeck:

If you don't ever allow Jenkins online, we can't really download timely notifications (like security advisories) from the server. Or do you mean that these messages should reach Jenkins via the browser-proxy method?

I expect that some installs aren't allowed through proxies. As we probably want to reserve these notifications for The Really Important Stuff, it should also reach users of those installs.

So my suggestion is to have a small(ish) JS in Jenkins that directs the user's browser to query subdomain.jenkins-ci.org and download the current project notifications, which are then shown somewhere on the UI. Similar to browser-based UC, with the difference that this cannot really break Jenkins, as there's no need to POST this back to Jenkins. It can all be done client-side.