title: How do I prevent and protect production deployment jobs in Jenkins from accidental triggering?
body: <p>I am trying to implement the following user journey with Jenkins:</p>
  
  <ul>
  <li>User logs on and selects a "deploy to production" task</li>
  <li>User is prompted to enter a passphrase and clicks "build"</li>
  <li>The build job uses the entered passphrase to unlock an SSH private key, which then grants it access to one or more production hosts</li>
  </ul>
  
  <p>This serves two purposes: the SSH key stored on the build host is protected and it also prevents accidental triggering of the "deploy" operation which is otherwise indistinguishable from any other Jenkins job. It does not appear that I can configure an SSH private key as a Jenkins credential without the passphrase and only provide it at job execution time. The Jenkins instance runs on Linux.</p>
  
  <p>How would you implement this? One possible solution is to use pre-/post-build shell scripts to start a new ssh-agent as part of the Jenkins job execution, and load the key into that, then stop it after the deployment is completed. It seems like there should be a more elegant way to do this though.</p>