I want to emulate the original Jenkins behaviour of doing stuff (like sending out notifications) when builds become unstable / fail or become successful again.
For that I need to query the previous build status, which can be done like this:
currentBuild.rawBuild.getPreviousBuild()?.getResult().toString()
However, rawBuild is supposed to be a "dangerous" object and as thus blacklisted and cannot be executed inside the Groovy sandbox.
Now, since I'm loading my Jenkins scripts from SCM, there is no way for me to deactivate the Groovy sandbox on a per-project level, but only for the whole Jenkins instance (i.e. through this), and this is certainly not something I want.
Is there any other way of determining the last build status of a job that conforms with the sandbox principles (and does not include hacks like querying the status via Jenkins' REST API) that I have missed?
No need to access rawBuild, instead you can do the following without any special permissions:
currentBuild.getPreviousBuild().result
This will allow you to see the result of the previous build without needing to have any special privileges set by the Jenkins administrator. It should be able to be run anywhere.
Global Variable Reference: https://www.jenkins.io/doc/book/pipeline/getting-started/#global-variable-reference
And more specifically, in your own Jenkins: ${YOUR_JENKINS_URL}/pipeline-syntax/globals#currentBuild
More information: https://support.cloudbees.com/hc/en-us/articles/217591038-How-to-Iterate-Through-the-Last-Successful-Builds-in-Pipeline-Job