Integrations
Connect Jenkins, GitLab CI/CD, GitHub Actions, Azure DevOps and Argo CD, what credentials each needs, what OpsNexus imports and how often.
On this page
An integration connects OpsNexus to an external CI/CD tool. OpsNexus imports the tool's pipelines and recent builds, shows them next to native OpsNexus pipelines, and can run and cancel them if you allow it.
Integrations belong to the current project. You find them under CI/CD → Integrations.
Supported tools
| Tool | What becomes a pipeline in OpsNexus | What becomes a build |
|---|---|---|
| Jenkins | Every job, including jobs inside folders (two folder levels deep) | The job's builds |
| GitLab CI/CD | Every project you choose (or every project you are a member of) | The project's pipelines |
| GitHub Actions | Every workflow in one repository | The workflow's runs |
| Azure DevOps | Every pipeline in one Azure DevOps project | The pipeline's builds |
| Argo CD | Every application | Successful syncs from the application's history, plus a running or failed sync operation |
For each pipeline OpsNexus keeps its name, project or folder, link and default branch. For each build it keeps the number, status, branch, commit, who triggered it, start and finish times, duration, a link, and the agent or queue when the tool reports one. OpsNexus imports up to the 20 newest builds per pipeline on each sync. Build logs stay in the original tool: Logs on the Builds page opens the build there.
Connect a tool
You need modify access to Integrations.
- Open CI/CD → Integrations and select Connect a tool.
- Choose tool, then select Next.
- Fill in Connection details:
- Display name, for example
Jenkins – Production. It must be unique in the project. - Environment:
prod,stagingordev. It is shown with the integration and its notifications. - The tool's fields (see below).
- Allow running and cancelling builds: off by default. Read-only sync works without it.
- Display name, for example
- Select Test connection. OpsNexus calls the tool with the details and shows the result.
- Select Save integration (or Save anyway if the test failed and you want to fix it later).
Secret fields go to the secret store (HashiCorp Vault in production) and are never shown again.
After saving, open the integration and select Sync now to import right away. Otherwise the first scheduled sync imports it.
Jenkins
| Field | Required | Value |
|---|---|---|
| Jenkins URL | Yes | For example https://jenkins.example.com |
| Username | Yes | A Jenkins user, for example a service account |
| API token | Yes (secret) | In Jenkins: user menu → Configure → API Token |
The user needs read access to the jobs you want to see. To run and cancel builds from OpsNexus, it also needs permission to build and cancel those jobs.
GitLab CI/CD
| Field | Required | Value |
|---|---|---|
| GitLab URL | Yes | For example https://gitlab.com or your self-managed URL |
| Personal access token | Yes (secret) | Scope read_api. Use api to run and cancel pipelines. |
| Project IDs | No | Comma-separated, for example 12, 45, 78. Leave empty to import every project you are a member of (archived projects are skipped). |
Running a pipeline starts a new GitLab pipeline on the chosen branch, or on the project's default branch.
GitHub Actions
| Field | Required | Value |
|---|---|---|
| Repository | Yes | owner/name |
| Access token | Yes (secret) | A fine-grained token with Actions: read. Use Actions: write to run and cancel. |
| API URL | No | Change only for GitHub Enterprise Server. Default https://api.github.com. |
One integration covers one repository. Add an integration per repository. Running a workflow sends a workflow_dispatch event, so the workflow must have a workflow_dispatch trigger.
Azure DevOps
| Field | Required | Value |
|---|---|---|
| Organization URL | Yes | For example https://dev.azure.com/your-org |
| Project | Yes | The Azure DevOps project name |
| Personal access token | Yes (secret) | Scope Build (Read). Use Build (Read & execute) to run and cancel. |
Argo CD
| Field | Required | Value |
|---|---|---|
| Argo CD server URL | Yes | For example https://argocd.example.com |
| API token | Yes (secret) | For example from argocd account generate-token --account opsnexus |
| Verify TLS certificate | No | Set to false only for test servers with self-signed certificates. |
Argo CD syncs appear on CI/CD → Deployments. Running an application starts a sync (to the branch or revision you give, if any). Cancelling ends the running sync operation.
# Example: a local Argo CD account for OpsNexus with an API token
argocd account generate-token --account opsnexusHow syncing works
- Every enabled integration syncs on a schedule. The default interval is 5 minutes, set by
INTEGRATION_SYNC_MINUTESin.env. See Environment variables. - Sync now on an integration's page queues a sync at once.
- Running a pipeline from OpsNexus queues a sync too, so the new build appears soon.
- Turn Scheduled sync enabled off on the integration's page to stop scheduled syncs. Sync now still works.
- Sync history on the integration's page lists each sync with its status, number of builds and log.
When a sync fails, the integration's status becomes error with the message, and OpsNexus sends the integration.error notification event (once, when it changes from connected to error).
When a sync finds a build that started or finished in the last 24 hours, OpsNexus sends build.started, build.succeeded or build.failed. For Argo CD it sends deployment.started, deployment.completed or deployment.failed. The first sync of a new integration sends no events. See Notifications.
Run and cancel external builds
With Allow running and cancelling builds on:
- Run on the CI/CD overview starts the pipeline in its tool.
- Cancel on the Builds page stops a running or queued build in its tool.
- The VS Code extension can do both.
Both actions need modify access to CI/CD pipelines and are recorded in the audit log as pipeline.trigger and build.cancel.
Leave write actions off for production tools you only want to watch. You can turn them on later on the integration's page.
Manage an integration
The integration's page shows its configuration, where its credentials are stored, its status and its sync history.
| Action | What it does | Access needed |
|---|---|---|
| Test connection | Checks the saved details. | Read |
| Sync now | Queues a sync. | Modify |
| Allow running and cancelling builds | Turns write actions on or off. | Modify |
| Scheduled sync enabled | Turns scheduled syncs on or off. | Modify |
| Replace credentials → Save credentials | Replaces secret fields, for example an expired token. | Modify |
| Delete integration | Deletes it with its pipelines and build history in OpsNexus. Nothing changes in the tool itself. You type the name to confirm. | Full |
The summary tiles on CI/CD → Integrations count integrations that are Connected, that Can't connect, and that are Pending or disabled.
Troubleshooting
| Problem | What to check |
|---|---|
| Test fails with an authentication error | The token or password, and that it has not expired. Replace it under Replace credentials. |
| Pipelines appear but some have no builds | The sync log says skipped builds for <name> with the tool's error. Usually the token cannot read that pipeline. |
| Run says write actions are turned off | Turn on Allow running and cancelling builds on the integration. |
| Run fails on GitHub Actions | The workflow needs a workflow_dispatch trigger, and the token needs Actions: write. |
| New builds appear late | Builds appear on the next sync. Lower INTEGRATION_SYNC_MINUTES or use Sync now. |