|
| 1 | +name: 'Setup JFrog' |
| 2 | +description: >- |
| 3 | + Exchange a GitHub OIDC token for a JFrog access token and configure |
| 4 | + Go and Python package managers to use the JFrog Artifactory proxy. |
| 5 | + Requires the calling job to have "permissions: id-token: write". |
| 6 | +
|
| 7 | +runs: |
| 8 | + using: 'composite' |
| 9 | + steps: |
| 10 | + - name: Get JFrog OIDC token |
| 11 | + shell: bash |
| 12 | + run: | |
| 13 | + set -euo pipefail |
| 14 | +
|
| 15 | + # Verify that the job has id-token: write permission. |
| 16 | + if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then |
| 17 | + echo "::error::OIDC token request URL/token not available. Does this job have 'permissions: id-token: write'?" |
| 18 | + exit 1 |
| 19 | + fi |
| 20 | +
|
| 21 | + # Exchange GitHub OIDC token for JFrog access token. |
| 22 | + ID_TOKEN=$(curl -sLS \ |
| 23 | + -H "User-Agent: actions/oidc-client" \ |
| 24 | + -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \ |
| 25 | + "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq -r .value) |
| 26 | + echo "::add-mask::${ID_TOKEN}" |
| 27 | +
|
| 28 | + if [ -z "$ID_TOKEN" ] || [ "$ID_TOKEN" = "null" ]; then |
| 29 | + echo "::error::Failed to obtain GitHub OIDC token." |
| 30 | + exit 1 |
| 31 | + fi |
| 32 | +
|
| 33 | + ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \ |
| 34 | + "https://databricks.jfrog.io/access/api/v1/oidc/token" \ |
| 35 | + -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq -r .access_token) |
| 36 | + echo "::add-mask::${ACCESS_TOKEN}" |
| 37 | +
|
| 38 | + if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then |
| 39 | + echo "::error::Failed to exchange GitHub OIDC token for JFrog access token." |
| 40 | + exit 1 |
| 41 | + fi |
| 42 | +
|
| 43 | + # Verify the token works. |
| 44 | + HTTP_STATUS=$(curl -sL -o /dev/null -w "%{http_code}" \ |
| 45 | + -H "Authorization: Bearer ${ACCESS_TOKEN}" \ |
| 46 | + "https://databricks.jfrog.io/artifactory/api/system/version") |
| 47 | + if [ "$HTTP_STATUS" != "200" ]; then |
| 48 | + echo "::error::JFrog auth check failed (HTTP ${HTTP_STATUS})." |
| 49 | + exit 1 |
| 50 | + fi |
| 51 | +
|
| 52 | + echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV" |
| 53 | +
|
| 54 | + - name: Configure Go to use JFrog proxy |
| 55 | + shell: bash |
| 56 | + run: |- |
| 57 | + set -euo pipefail |
| 58 | + CREDS="gha-service-account:${JFROG_ACCESS_TOKEN}" |
| 59 | + echo "::add-mask::${CREDS}" |
| 60 | + echo "GOPROXY=https://${CREDS}@databricks.jfrog.io/artifactory/api/go/db-golang,direct" >> "$GITHUB_ENV" |
| 61 | + echo "GONOSUMDB=*" >> "$GITHUB_ENV" |
| 62 | +
|
| 63 | + - name: Configure Python (uv/pip) to use JFrog proxy |
| 64 | + shell: bash |
| 65 | + run: |- |
| 66 | + set -euo pipefail |
| 67 | + CREDS="gha-service-account:${JFROG_ACCESS_TOKEN}" |
| 68 | + echo "::add-mask::${CREDS}" |
| 69 | + echo "UV_INDEX_URL=https://${CREDS}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV" |
| 70 | + echo "PIP_INDEX_URL=https://${CREDS}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV" |
0 commit comments