How a Jenkins Job Broke our Jenkins UI

This post details a specific debugging incident where a Jenkins UI became unresponsive due to a custom Groovy script that interacted with the Jenkins API to mark nodes offline. The issue was traced back to a recent CVE fix in the Script Security Plugin that tightened the Groovy sandbox, causing it to reject unsandboxed property gets from a custom `OfflineMessage` class. The fix involved replacing the custom `OfflineMessage` class with a simpler `OfflineCause.ByCLI` constructor that accepts a String message, thus avoiding the sandbox restrictions. It also provides takeaways on maintaining Jenkins environments, keeping API integrations lean, monitoring the Groovy sandbox and plugin updates, and having well-maintained runbooks.