fix(codespaces): fix reverse proxy warning and enable CSP

[gounthar]

Problem

Two administrative monitor warnings appeared in Jenkins when running under GitHub Codespaces:

1. "Reverse proxy set up is broken" — codespacesURL.sh patches the local dockerfiles/jenkins.yaml on the host, but the controller uses a pre-built GHCR image where the file is baked in as /usr/share/jenkins/ref/jenkins.yaml.override. The host-side edit is never seen by the running container.

2. CSP disabled — no Content-Security-Policy configuration was present in JCasc.

Root cause of the URL issue

The discovery_and_jcasc_modifier container (find-name.sh) already modifies /var/jenkins_home/jenkins.yaml at runtime and triggers a JCasc reload. It is the correct place to set the Codespaces root URL — but it had no access to the CODESPACE_NAME / GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN environment variables.

Changes

docker-compose.yaml

Pass the two Codespaces env vars into the discovery container (Docker Compose forwards them transparently from the host environment; they are empty strings in non-Codespaces environments, so there is no impact on local or CI runs).

dockerfiles/agent-discovery/find-name.sh

When the Codespaces vars are set, update unclassified.location.url to the correct forwarding URL and add hudson.diagnosis.ReverseProxySetupMonitor to disabledAdministrativeMonitors. This runs before the final JCasc reload, so the correct URL is loaded on first startup.

dockerfiles/jenkins.yaml

Add security.contentSecurityPolicy with a policy that allows Jenkins' own UI to function (inline styles/scripts are required by Jenkins core) while establishing a defined CSP baseline.

[Copilot]

Pull request overview

This PR updates the Jenkins-on-Codespaces setup so Jenkins starts with a correct external root URL (avoiding reverse-proxy administrative monitor warnings) and with an explicit Content-Security-Policy configured via JCasC.

Changes:

• Pass Codespaces URL-related environment variables into the agent discovery / JCasC modifier container.
• Update find-name.sh to set unclassified.location.url to the Codespaces forwarded URL and disable ReverseProxySetupMonitor when running in Codespaces.
• Add a baseline security.contentSecurityPolicy.header configuration to dockerfiles/jenkins.yaml.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
docker-compose.yaml	Forwards CODESPACE_NAME and GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN into the discovery container so it can compute the public URL at runtime.
dockerfiles/agent-discovery/find-name.sh	Detects Codespaces and patches JCasC (location.url + disables reverse-proxy monitor) before the final JCasC reload.
dockerfiles/jenkins.yaml	Defines a CSP header in JCasC to establish an explicit CSP baseline for Jenkins UI.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.