{
  "context": "Tests whether the agent uses Declarative pipeline syntax (not scripted), retrieves credentials from the Jenkins Credentials Store rather than pipeline parameters, includes workspace cleanup in post, and adds standard pipeline options.",
  "type": "weighted_checklist",
  "checklist": [
    {
      "name": "Declarative syntax",
      "description": "Jenkinsfile starts with 'pipeline {' (Declarative syntax) — NOT 'node {' (Scripted syntax)",
      "max_score": 12
    },
    {
      "name": "No credential parameters",
      "description": "Jenkinsfile does NOT contain a parameters block with string or password entries for credentials (API keys, passwords, tokens)",
      "max_score": 14
    },
    {
      "name": "Credentials Store used",
      "description": "Registry credentials are accessed via credentials() binding in an environment block OR via withCredentials([...]) — NOT hardcoded strings",
      "max_score": 12
    },
    {
      "name": "cleanWs in post",
      "description": "Jenkinsfile includes a post block with an always { cleanWs() } or always { deleteDir() } call",
      "max_score": 10
    },
    {
      "name": "post block exists",
      "description": "Jenkinsfile contains a post { } block at the pipeline level (not just inside a stage)",
      "max_score": 8
    },
    {
      "name": "timeout option",
      "description": "Jenkinsfile options block includes a timeout() directive",
      "max_score": 8
    },
    {
      "name": "buildDiscarder option",
      "description": "Jenkinsfile options block includes a buildDiscarder(logRotator(...)) directive",
      "max_score": 8
    },
    {
      "name": "timestamps option",
      "description": "Jenkinsfile options block includes a timestamps() directive",
      "max_score": 6
    },
    {
      "name": "disableConcurrentBuilds",
      "description": "Jenkinsfile options block includes disableConcurrentBuilds()",
      "max_score": 6
    },
    {
      "name": "Stages present",
      "description": "Jenkinsfile contains at least 3 named stages covering build, test, and a deployment-related step",
      "max_score": 8
    },
    {
      "name": "No hardcoded secret values",
      "description": "No literal password, token, or secret string appears in the Jenkinsfile body outside of a credentialsId reference",
      "max_score": 8
    }
  ]
}