[JENKINS-64489] Change Log - Credentials is 116G folder: stop updating password if identical

This is the case I have:

1.  Script updates jenkins credential id "ABC123"' secret to "Password" which was "Password before.

2. This updates the credential with a new encrypted string.

3. Credential log copies the 11M credential.xml for every change.   The folder has grown to 116G in the last 24 hours.

 

Now the cause is a rogue script I have updated the password from something like "Password" to "Password"  aka the passwords are identical but jenkins generates a new encrypted string.   Thus change log sees it as a change and records it.   So in 24 hours I have 116G worth of change logs...

So my feature request.   Don't update the credential.xml if nothing has actually changed, specifically for the encrypted strings.   and downstream... don't create a change log entry if nothing has changed.

From my side I'll start trying to detect and kill these scripts but would be nice to get something on the Jenkins side too.

---
Originally reported by mikeycarter, imported from: Change Log - Credentials is 116G folder: stop updating password if identical

• assignee: escoem
  
• status: Open
  
• priority: Minor
  
• component(s): changelog-history-plugin, credentials-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 1
  
• imported: 2025-12-08
  

Raw content of original issue

This is the case I have:


1.  Script updates jenkins credential id "ABC123"' secret to "Password" which was "Password before.


2. This updates the credential with a new encrypted string.


3. Credential log copies the 11M credential.xml for every change.   The folder has grown to 116G in the last 24 hours.


 


Now the cause is a rogue script I have updated the password from something like "Password" to "Password"  aka the passwords are identical but jenkins generates a new encrypted string.   Thus change log sees it as a change and records it.   So in 24 hours I have 116G worth of change logs...


So my feature request.   Don't update the credential.xml if nothing has actually changed, specifically for the encrypted strings.   and downstream... don't create a change log entry if nothing has changed.


From my side I'll start trying to detect and kill these scripts but would be nice to get something on the Jenkins side too.

Start by tracing credential update handling in the credentials-plugin and change recording in the changelog-history-plugin. Reproduce an update where the secret is identical but its encrypted representation changes, then verify that credential.xml is not rewritten and no downstream change-log entry is created.

Written by the indexing model from the issue text.