Jenkins

This page covers the community Gradle Jenkins plugin, which links each build’s Build Scan from Jenkins. To cache Maven, Gradle, npm, pip, or SonarScanner dependencies through the Develocity Artifact Cache instead, see Configuring Jenkins for Artifact Cache.

Prerequisites

The Develocity plugin or extension is configured in your build. See the documentation for Gradle, Maven, sbt, npm, or Python.
You have a Develocity server URL and access key.
Jenkins administrator access to install plugins and manage credentials.

Install the Gradle Jenkins Plugin

Install the Gradle Jenkins plugin from the Jenkins Plugin Manager.

The plugin prominently displays Build Scan links for any Gradle or Maven build. It also instruments all CI jobs and configures the Develocity Gradle plugin or Maven extension centrally, without modifying individual projects.

For the full configuration guide, see the Gradle Jenkins plugin README.

Store the Access Key as a Credential

Store your Develocity access key in Jenkins as a Secret text credential under Manage Jenkins → Credentials.

The access key value uses the format «server host name»=«access key»:

develocity.example.com=7w5kbqqjea4vonghohvuyra5bnvszop4asbqee3m3sm6dbjdudtq

Reference the credential in your Jenkinsfile using the withCredentials step so the access key is available as the DEVELOCITY_ACCESS_KEY environment variable during the build:

withCredentials([string(credentialsId: 'develocity-access-key', variable: 'DEVELOCITY_ACCESS_KEY')]) { (1)
    sh './gradlew build'
}

1	Replace `develocity-access-key` with the credential ID you chose when creating the credential in Jenkins.

Authenticate With Workload Identity

Instead of the stored Secret text credential from Store the Access Key as a Credential, bind an OIDC token minted for each build and supply it as the same DEVELOCITY_ACCESS_KEY variable. Develocity accepts the OIDC token directly in place of an access key.

The Gradle Jenkins plugin does not support workload identity in the initial 2026.3 release. You can still use workload identity without it, as shown below.

Configure a Workload Identity rule in Develocity before using this flow, using the Jenkins provider example on that page for the issuer and audience. The audience Jenkins issues the token for must match the Audience configured on that rule.

The OpenID Connect Provider plugin issues the token as an OpenID Connect id token credential. Bind that credential in place of the Secret text credential, in host-qualified «server host name»=«token» form:

withCredentials([string(credentialsId: 'develocity-oidc-token', variable: 'DV_OIDC_TOKEN')]) { (1)
    withEnv(["DEVELOCITY_ACCESS_KEY=develocity.example.com=${DV_OIDC_TOKEN}"]) {
        sh './gradlew build'
    }
}

1	Replace `develocity-oidc-token` with the ID of the OpenID Connect id token credential you created with the OpenID Connect Provider plugin.

The Gradle plugin rejects a bare token, so keep the host name prefix.

By default the token identifies only the job through its sub claim. To scope the Develocity rule on the branch or another build attribute, add a custom claim template in the OpenID Connect Provider plugin under Manage Jenkins Security ID Token that exposes a claim such as branch. See the Jenkins provider example for the matching claim requirements.

Verify the Integration

After your first pipeline run, the Gradle Jenkins plugin displays a direct link to the Build Scan from the Jenkins build page. Open your Develocity server and navigate to Build Scan to confirm your build appears there. Install the Common Custom User Data plugin to tag builds as CI and enrich each Build Scan with the Git branch, commit SHA, and a link back to the Jenkins build.