General

You can choose one of the following two methods to set the connection details to the JFrog Platform as secrets:

• Storing the connection details using separate environment variables
• Storing the connection details using single Config Token

Storing the connection details using separate environment variables

The connection details of the JFrog platform used by JFrog CLI can be stored as secrets. You can use one of the following two methods to define and store the JFrog Platform connection details as secrets.

You can set the connection details to your JFrog Platform by using one of the following environment variables combinations:

1. JF_URL (no authentication)
2. JF_URL + JF_USER + JF_PASSWORD (basic authentication)
3. JF_URL + JF_ACCESS_TOKEN (authentication using a JFrog Access Token)

You can use these environment variables in your workflow as follows:

- uses: jfrog/setup-jfrog-cli@v4
  env:
    # JFrog platform url (for example: https://acme.jfrog.io)
    JF_URL: ${{ secrets.JF_URL }}

    # Basic authentication credentials
    JF_USER: ${{ secrets.JF_USER }}
    JF_PASSWORD: ${{ secrets.JF_PASSWORD }}
    or
    # JFrog Platform access token
    JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}
- run: |
    jf rt ping

Storing the connection details using single Config Token

1. Make sure JFrog CLI is installed on your local machine by running jf -v.
2. Configure the details of the JFrog platform by running jf c add.
3. Export the details of the JFrog platform you configured, using the server ID you chose. Do this by running jf c export <SERVER ID>.
4. Copy the generated Config Token to the clipboard and save it as a secret on GitHub.

To use the saved JFrog platform configuration in the workflow, all you need to do it to expose the secret to the workflow. The secret should be exposed as an environment variable with the JFENV prefix. Here's how you do this:

- uses: jfrog/setup-jfrog-cli@v4
  env:
      JF_ENV_1: ${{ secrets.JF_SECRET_ENV_1 }}
- run: |
      # Ping the server
      jf rt ping

As you can see in the example above, we created a secret named JF_SECRET_ENV_1 and exposed it to the workflow as the JF_ENV_1 environment variable. That's it - the ping command will now ping the configured Artifactory server.

If you have multiple Config Tokens as secrets, you can use all of them in the workflow as follows:

- uses: jfrog/setup-jfrog-cli@v4
  env:
      JF_ENV_1: ${{ secrets.JF_SECRET_ENV_1 }}
      JF_ENV_2: ${{ secrets.JF_SECRET_ENV_2 }}
- run: |
      # Set the utilized JFrog configuration by providing the server ID (configured by the 'jf c add' command).
      jf c use local-1
      # Ping local-1 Artifactory server
      jf rt ping
      # Now use the second sever configuration exposed to the Action.
      jf c use local-2
      # Ping local-2 Artifactory server
      jf rt ping

General

The sensitive connection details, such as the access token used by JFrog CLI on the JFrog platform, can be automatically generated by the action instead of storing it as a secret in GitHub. This is made possible by leveraging the OpenID-Connect (OIDC) protocol. This protocol can authenticate the workflow issuer and supply a valid access token, requiring only the JF_URL environment variable. Learn more about this integration in this blog post. To utilize the OIDC protocol, follow these steps:

JFrog Platform configuration

1. Configure an OIDC Integration: This phase sets an integration between GitHub Actions to the JFrog platform.
   1. Navigate to the Administration tab In the JFrog Platform UI
   2. Click General | Manage Integrations
   3. Click New Integration | OpenID Connect:
   4. Configure the OIDC integration:

2. Configure an identity mapping: This phase sets an integration between a particular GitHub repository to the JFrog platform.

   An identity mapping is a configuration object utilized by the JFrog Platform to associate incoming OIDC claims with particular selected fields. These fields might include repository, actor, workflow, and others. To configure the identity mapping, click on the identity mapping created in section 1 and then click on Add Identity Mapping. Fill in priority 1 and fill out all required fields:

   You have the flexibility to define any valid list of claims required for request authentication. You can check a list of the possible claims here. Example Claims JSON:

   {
       "repository": "repository-owner/repository-name"
   }
   

Workflow configuration

1. Set required permissions: In the course of the protocol's execution, it's imperative to acquire a JSON Web Token (JWT) from GitHub's OIDC provider. To request this token, it's essential to configure the specified permission in the workflow file:

   permissions:
       id-token: write
   

2. Pass the 'oidc-provider-name' input to the Action (Required): The 'oidc-provider-name' parameter designates the OIDC configuration whose one of its identity mapping should align with the generated JWT claims. This input needs to align with the 'Provider Name' value established within the OIDC configuration in the JFrog Platform.

3. Pass the 'oidc-audience' input to the Action (Optional): The 'oidc-audience' input defines the intended recipients of an ID token (JWT), ensuring access is restricted to authorized recipients for the JFrog Platform. By default, it contains the URL of the GitHub repository owner. It enforces a condition, allowing only workflows within the designated repository/organization to request an access token. Read more about it here.

Example step utilizing OpenID Connect:

- uses: jfrog/setup-jfrog-cli@v4
  env:
      JF_URL: ${{ secrets.JF_URL }}
  with:
      oidc-provider-name: setup-jfrog-cli