[JENKINS-39773] Check if script needs approval before executing it

It often happens that I modify a pipeline script, it runs for several minutes in Jenkins and then fails because I added a method call that needs approval. Then I approve that method, run it again and have to hope that there's not another method call I have to approve.

So IMHO it'd be great if Jenkins did some kind of "dry run" on a script to check if there's any method signature that still needs approval and immediately fails before the script was actually executed.

This may also have severe consequences, e.g. if a component was deployed and the script fails afterwards and it's impossible to roll back the deployment.

Also, it's not possible to add script approvals manually using the web interface so I actually have to wait for the script to fail.

---
Originally reported by maxzilla, imported from: Check if script needs approval before executing it

• status: Open
  
• priority: Major
  
• component(s): script-security-plugin
  
• resolution: Unresolved
  
• votes: 0
  
• watchers: 3
  
• imported: 2025-12-09
  

Raw content of original issue

It often happens that I modify a pipeline script, it runs for several minutes in Jenkins and then fails because I added a method call that needs approval. Then I approve that method, run it again and have to hope that there's not another method call I have to approve.


So IMHO it'd be great if Jenkins did some kind of "dry run" on a script to check if there's any method signature that still needs approval and immediately fails before the script was actually executed.


This may also have severe consequences, e.g. if a component was deployed and the script fails afterwards and it's impossible to roll back the deployment.


Also, it's not possible to add script approvals manually using the web interface so I actually have to wait for the script to fail.

Start by examining the script-security-plugin's script approval flow and how pipeline scripts are checked before execution. Review the requested dry-run behavior and web-based approval requirement; done means unapproved method signatures are identified before execution and can be approved without waiting for a failure.

Written by the indexing model from the issue text.