Explains using Jenkins Shared Library libraryResource to load a parameterized Trivy shell script, write and execute it from pipelines via a loader and Groovy wrapper.
What are libraryResources?libraryResource is a Jenkins Shared Library helper that loads non-Groovy static assets (for example, shell scripts, YAML, JSON) stored under a resources directory of the shared library. It returns the file contents as a string so your pipeline or library code can read those assets at runtime.In this lesson we’ll demonstrate a real use case: packaging a parameterized Trivy scan script in the shared library and using libraryResource to persist and execute it from a pipeline.
In our shared library we had a trivyScan.groovy method that hard-coded multiple Trivy image commands for different severities and exit codes. That looked like this:
Hard-coding every combination of severity and exit behavior makes maintenance difficult when requirements change. We want a reusable approach where pipeline authors can supply the image name, severity, and exit code at invocation time.
Add a parameterized shell script to resources/scripts/trivy.sh inside the shared library.
Implement a small loader library (loadScript) that uses libraryResource to read the resource, writes it into the workspace, and sets executable permissions.
Add a Groovy wrapper (trivyScanScript.groovy) that calls the loader and executes the script with flexible parameters supplied via a Map (config).
This pattern keeps the script editable without changing compiled Groovy code and enables pipeline authors to control behavior via simple config.
Create a loader in vars/loadScript.groovy that retrieves the script from resources using libraryResource, writes it to the workspace, and marks it executable:
libraryResource "scripts/${config.name}" reads the file stored at resources/scripts/${config.name} in the shared library and returns its contents as a String.
writeFile persists that string into the pipeline workspace; chmod +x makes the file executable so it can be run with sh.
libraryResource loads the resource as a string. To execute a shell script you must write it to the workspace (e.g., using writeFile) and set executable permissions before running it.
Add a wrapper in vars/trivyScanScript.groovy that uses the loader and executes the script. Using a Map parameter lets callers pass named arguments rather than positional ones:
def vulnerability(Map config = [:]) { // config.name -> name of the script in resources/scripts, e.g. 'trivy.sh' // config.imageName, config.severity, config.exitCode -> arguments to the script loadScript(name: 'trivy.sh') sh "./trivy.sh ${config.imageName} ${config.severity} ${config.exitCode}"}
Why use a Map?
A Map (config) provides flexible key/value arguments so pipeline authors pass only the values they need and the wrapper can validate or apply defaults.
Defaulting to [:] prevents null/argument errors if the caller omits the map; you can add validation and defaulting logic inside vulnerability as needed.
From your Jenkinsfile or another library caller you invoke trivyScanScript.vulnerability(config) with a Map (keys: name, imageName, severity, exitCode).
// Example usage in a JenkinsfiletrivyScanScript.vulnerability( name: 'trivy.sh', imageName: 'myregistry/myimage:latest', severity: 'CRITICAL', exitCode: 1)
This approach separates scan logic (in a shell script) from pipeline orchestration (Groovy wrapper), making maintenance and updates easier while letting pipelines control behavior through a simple configuration map.
Example from the Jenkins docs showing libraryResource usage:
// Example: load resource into a variable (string)def request = libraryResource 'com/mycorp/pipeline/somelib/request.json'
Use these references to extend the loader pattern for other static assets (YAML templates, JSON configs, helper scripts) that should live in your shared library’s resources directory.
