Architecting Secure and Sustainable Enterprise Java Delivery Pipelines: Managing Mixed Java Versions, Legacy Modularity, and DevSecOps Automation in Non-Containerized CI/CD Environments
Published 2025-11-05
Keywords
- Enterprise Java,
- CI/CD pipelines,
- Jenkins,
- DevSecOps
How to Cite
Copyright (c) 2025 Dr. Alexander M. Rothwell

This work is licensed under a Creative Commons Attribution 4.0 International License.
Abstract
Enterprise Java ecosystems continue to operate under complex constraints shaped by long-lived legacy systems, mixed Java version dependencies, stringent regulatory requirements, and cautious adoption of containerization technologies. While cloud-native and container-based paradigms dominate contemporary discourse, a substantial proportion of mission-critical enterprise systems still rely on non-containerized continuous integration and continuous delivery (CI/CD) pipelines. These environments face unique challenges, particularly when managing multiple Java versions, modularization transitions, dependency risk propagation, and integrated security controls without disrupting operational stability. This research presents an in-depth, theory-driven examination of enterprise-grade CI/CD pipeline architectures for mixed Java version environments using Jenkins in non-containerized contexts. Drawing exclusively from established academic, industry, and standards-based references, the study synthesizes insights from Java platform evolution, modularity research, garbage collection optimization, dependency management, and DevSecOps governance frameworks. The methodology employs a qualitative analytical approach, integrating comparative literature analysis, architectural reasoning, and process-oriented interpretation to derive best-practice patterns. The findings reveal that sustainable pipeline design in non-containerized environments depends on deliberate version isolation strategies, disciplined dependency governance, modular refactoring aligned with Java Platform Module System principles, and deeply embedded security automation. The discussion critically evaluates trade-offs between modernization and operational risk, highlighting how policy-as-code, static and dynamic analysis tools, and compliance-driven observability can be harmonized within Jenkins-centric pipelines. The study concludes that non-containerized CI/CD architectures, when systematically engineered, remain viable and strategically relevant, offering a pragmatic modernization pathway for enterprises balancing innovation with legacy continuity.
References
- Aqua Security. (2023). Trivy open source vulnerability scanner.
- Chen, L., & Thakkar, M. (2021). Garbage collection optimization in large-scale Java applications. Proceedings of the IEEE International Conference on Software Maintenance and Evolution.
- Deligiannis, I., et al. (2021). Challenges in modularizing legacy Java systems: An empirical study. Empirical Software Engineering, 26(2), 25.
- Deligiannis, N., Smaragdakis, Y., & Chatrchyan, S. (2019). Migrating to Java 9 modules: Lessons from the trenches. Proceedings of the ACM on Programming Languages, 3(OOPSLA), 1–25.
- Deligiannis, N., Spinellis, D., & Gousios, G. (2022). Analyzing modularity in Java projects after JPMS adoption. Empirical Software Engineering Journal, 27(1), 1–29.
- Gupta, M., & Saxena, A. (2020). An empirical study of Java LTS versions in enterprise software systems. Journal of Software Engineering and Applications, 13(8), 325–337.
- Jenkins. (2023). Pipeline syntax and tools. Jenkins documentation.
- Jenkins Project. (2024). Jenkins documentation: Pipeline and plugin ecosystem.
- Kathi, S. R. (2025). Enterprise-grade CI/CD pipelines for mixed Java version environments using Jenkins in non-containerized environments. Journal of Engineering Research and Sciences, 4(9), 12–21. https://doi.org/10.55708/js0409002
- Malhotra, S. (2021). Dependency management for Java frameworks: The case of Spring and Jersey. International Journal of Software Engineering & Applications, 12(4), 45–57.
- Mehta, N. (2022). DevSecOps: A leader’s guide to producing secure software without compromising flow, feedback, and continuous improvement. IT Revolution.
- OpenJDK. (2021). JEP index.
- Open Policy Agent. (2023). Policy as code for secure CI/CD.
- Oracle. (2021). Java SE support roadmap.
- Oracle. (2023). Java SE support roadmap.
- Oracle Corporation. (2021). CLDR in JDK 9 and later (JEP 252).
- Oracle Corporation. (2022). Java microbenchmark harness.
- OWASP Foundation. (2023). OWASP dependency-check.
- OWASP Foundation. (2023). OWASP ZAP project.
- PCI Security Standards Council. (2022). Payment card industry data security standard v4.0.
- Shah, A., et al. (2020). Risks in transitive dependency upgrades in Java projects. Proceedings of the IEEE International Conference on Software Maintenance and Evolution, 27–36.
- Shah, P., Reddy, A., & Ma, J. (2022). Risk propagation in Java dependency trees: A transitive analysis approach. Software: Practice and Experience, 52(9), 1754–1772.
- SonarSource. (2023). Static analysis for Java applications.
- SonarSource. (2024). SonarQube documentation.
- Snyk Ltd. (2023). State of Java security report.
- Tomlinson, B. (2021). CI/CD without containers: Lessons from legacy environments. Proceedings of the DevOps Enterprise Summit.
- Venkat, G., & Saito, T. (2022). Modern Java language features: From Java 9 to Java 17. Java Magazine, Oracle.
- Splunk Inc. (2023). Security information and event management best practices.