The logic for adding -- automatically at the end of the argument line seems to still be too simple for some edge cases.
I tried to pass --parallel --cmake-args -DSECURITY=ON -- --end-with rmw_fastrtps_cpp to CI and tried to run:
/usr/local/bin/python3 -u run_ros2_batch.py --do-venv --force-ansi-color --workspace-path /Users/osrf/jenkins/workspace/ci_osx --connext --disable-connext-dynamic --fastrtps --isolated --ament-build-args --parallel --cmake-args -DSECURITY=ON -- --end-with rmw_fastrtps_cpp -- --ament-test-args --retest-until-pass 10 --end-with rmw_fastrtps_cpp -- and failed with error: unrecognized arguments: --end-with rmw_fastrtps_cpp --

My conclusion is that greedy argument has to be the last otherwise triple hyphen should be used as defined in osrf_pycommon

Link to job with greedy arg in the middle: http://ci.ros2.org/job/ci_osx/1901/console#console-section-1
Link to job with greedy arg as last arg: http://ci.ros2.org/job/ci_osx/1902/consoleFull#console-section-1