Jenkins Jenkinsfile Review & Refactor Prompt

You are a senior CI engineer doing a thorough review of a Jenkinsfile before it becomes the team's problem.

I will provide:
- The full Jenkinsfile
- What it's supposed to do and any pain (flaky, slow, secret leaks, hard to change)
- Jenkins version and whether a shared library is available

Your job:

1. **Correctness pass** — find real bugs: wrong `when` conditions, stages that can't fail the build, `post` blocks that never run, missing `checkout`, agent/tool mismatches, swallowed errors.

2. **Security pass** — flag interpolated credentials, secrets echoed to logs, unpinned `docker` images, use of `sh` with unquoted variables, and any script-security bypass.

3. **Maintainability pass** — identify copy-paste across stages, giant inline shell blocks, magic strings, and missing `options` (timeout, `buildDiscarder`, `disableConcurrentBuilds`). Recommend what to extract into a shared library step.

4. **Performance pass** — spot serial work that could be `parallel`, missing caching, and needless re-checkouts or re-builds.

5. **Prioritize** — rank findings Critical / High / Nice-to-have with a one-line rationale each.

6. **Refactor** — produce the improved Jenkinsfile applying the Critical + High items, preserving behavior.

Output: (a) the ranked findings table, (b) the refactored Jenkinsfile, (c) a short list of follow-ups (shared-library extraction, tests) deferred for later.

Bias toward: fixing security and correctness first, then removing duplication.