JFrog OIDC GitHub Action

This GitHub Action sets up OIDC based authentication with a JFrog installation. The token can be used as a Bearer token for authentication by the Jfrog CLI, cURL or other tooling. Basic authentication is not possible as there is no username.

Preparation

In JFrog configure:

• an OIDC integration
  • URL for GitHub is fixed at https://token.actions.githubusercontent.com
• an identity mapping
  • remember the claims JSON should include the iss claim and at least repository_owner, or repository. See Security hardening with OpenID Connect

In GitHub Actions, set secrets or variables representing the audience, provider and URL.

Usage

Use the action as follows:

permissions:
  contents: read
  id-token: write
steps:
  - name: Checkout
    id: checkout
    uses: actions/checkout@v4

  - name: JFrog Access Token
    id: jfrog
    uses: bdellegrazie/gha-jfrog-oidc@v1
    with:
      audience: ${{ secrets.JFROG_OIDC_AUDIENCE }}
      provider: ${{ secrets.JFROG_OIDC_PROVIDER }}
      url: ${{ secrets.JFROG_OIDC_URL }}

  - name: Retrieve Artifact
    id: retrieve
    run: |
      curl -fsSL\
       --max-time 60\
       --header 'authorization: Bearer ${{ steps.jfrog.outputs.token }}'\
       "${JFROG_OIDC_URL}/artifactory/<path_to_artifact>"

Dependency License Management

This template includes a GitHub Actions workflow, licensed.yml, that uses Licensed to check for dependencies with missing or non-compliant licenses. This workflow is initially disabled. To enable the workflow, follow the below steps.

1. Open licensed.yml

2. Uncomment the following lines:

   # pull_request:
   #   branches:
   #     - main
   # push:
   #   branches:
   #     - main

3. Save and commit the changes

Once complete, this workflow will run any time a pull request is created or changes pushed directly to main. If the workflow detects any dependencies with missing or non-compliant licenses, it will fail the workflow and provide details on the issue(s) found.

Updating Licenses

Whenever you install or update dependencies, you can use the Licensed CLI to update the licenses database. To install Licensed, see the project's Readme.

To update the cached licenses, run the following command:

licensed cache

To check the status of cached licenses, run the following command:

licensed status