Secrets, Post Stages, Git Panel, and More

This release is a big one. Five features that have been on the roadmap for a while all landed together, and each of them changes how you interact with Plumber day-to-day.

Secrets management

Jenkinsfiles frequently reference credentials via withCredentials or environment blocks, and until now Plumber had no way to resolve them. That changes with the new SECRETS tab in the sandbox panel.

You pick a backend:

• ▸env-file -- point at a .env file on disk and Plumber reads keys from it at run time
• ▸HashiCorp Vault -- configure a Vault address, token, and secret path
• ▸AWS Secrets Manager -- configure a region and secret ARN
• ▸Azure Key Vault -- configure a vault URL and secret name

All secret values are masked in log output the moment they are fetched. You will see **** wherever the raw value would appear. The "Test and Fetch" button previews which keys were resolved so you can confirm the connection before running your pipeline.

Configuration is stored per sandbox environment under ExtendedSettings.Secrets, so your production credentials never leak into a dev environment config.

Post stage

The post {} block is now parsed and executed natively. Plumber supports all five conditions:

post {
  always    { sh 'echo always runs' }
  success   { sh 'echo pipeline passed' }
  failure   { sh 'echo pipeline failed' }
  unstable  { sh 'echo pipeline is unstable' }
  cleanup   { sh 'echo cleanup runs last' }
}

Conditions run in the correct Jenkins order after the final stage completes. always and cleanup fire regardless of outcome. success, failure, and unstable fire only when the pipeline status matches. This means your notification steps, artifact cleanup, and test report uploads work the same as they do on a real Jenkins server.

Git panel

The new git panel sits alongside the pipeline view and has three tabs:

Changes shows your working-tree diff with added, modified, and deleted files. You can stage files, write a commit message, and commit without leaving the app.

Graph renders your commit history as a visual branch graph. Merges and diverging branches are drawn as connecting lines, making it easy to see where feature branches split and rejoin.

Branches lists local and remote branches. Switch branches with a single click.

This is not a replacement for a full git client, but it covers the core loop of editing a Jenkinsfile, committing the change, and moving on without switching to a terminal or another app.

Workspace file tracking

When you connect to a Jenkins server, Plumber now tracks every file in your configured watch directory. The system polls every three seconds and marks each file with a status badge:

• ▸A -- added since the last push
• ▸M -- modified since the last push
• ▸D -- deleted since the last push
• ▸checkmark -- unchanged

When you push, Plumber uploads all tracked files alongside the Jenkinsfile in a single operation. New files in the watch directory are auto-discovered and added to the list. This means your shared scripts, property files, and helper libraries are always in sync with your Jenkins workspace without manual uploads.

Paths in the file list are relative to the configured WatchRoot, so they resolve correctly on the Jenkins side regardless of where you have the project checked out locally.

Light mode and theming

Settings now has a Dark / Light segmented control under the General tab. Switching themes is instant -- no restart required. The entire UI swaps: background colors, surface colors, log output, the pipeline timeline, status badges, and the code editor all update in one pass.

Both palettes were tuned to maintain the same contrast ratios, so nothing becomes unreadable when you switch. The chosen theme is persisted across restarts.

All five features are in the current build. If you hit anything unexpected, open an issue and include your Plumber version from the About screen.