name: 'Setup JFrog'

description: >-

Exchange a GitHub OIDC token for a JFrog access token and configure

Go and Python package managers to use the JFrog Artifactory proxy.

Requires the calling job to have "permissions: id-token: write".

runs:

using: 'composite'

steps:

- name: Get JFrog OIDC token

shell: bash

run: |

set -euo pipefail

# Verify that the job has id-token: write permission.

if [ -z "${ACTIONS_ID_TOKEN_REQUEST_URL:-}" ] || [ -z "${ACTIONS_ID_TOKEN_REQUEST_TOKEN:-}" ]; then

echo "::error::OIDC token request URL/token not available. Does this job have 'permissions: id-token: write'?"

exit 1

fi

# Exchange GitHub OIDC token for JFrog access token.

ID_TOKEN=$(curl -sLS \

-H "User-Agent: actions/oidc-client" \

-H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \

"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq -r .value)

echo "::add-mask::${ID_TOKEN}"

if [ -z "$ID_TOKEN" ] || [ "$ID_TOKEN" = "null" ]; then

echo "::error::Failed to obtain GitHub OIDC token."

exit 1

fi

ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \

"https://databricks.jfrog.io/access/api/v1/oidc/token" \

-d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq -r .access_token)

echo "::add-mask::${ACCESS_TOKEN}"

if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then

echo "::error::Failed to exchange GitHub OIDC token for JFrog access token."

exit 1

fi

# Verify the token works.

HTTP_STATUS=$(curl -sL -o /dev/null -w "%{http_code}" \

-H "Authorization: Bearer ${ACCESS_TOKEN}" \

"https://databricks.jfrog.io/artifactory/api/system/version")

if [ "$HTTP_STATUS" != "200" ]; then

echo "::error::JFrog auth check failed (HTTP ${HTTP_STATUS})."

exit 1

fi

echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"

- name: Configure Go to use JFrog proxy

shell: bash

run: |-

set -euo pipefail

CREDS="gha-service-account:${JFROG_ACCESS_TOKEN}"

echo "::add-mask::${CREDS}"

echo "GOPROXY=https://${CREDS}@databricks.jfrog.io/artifactory/api/go/db-golang,direct" >> "$GITHUB_ENV"

echo "GONOSUMDB=*" >> "$GITHUB_ENV"

- name: Configure Python (uv/pip) to use JFrog proxy

shell: bash

run: |-

set -euo pipefail

CREDS="gha-service-account:${JFROG_ACCESS_TOKEN}"

echo "::add-mask::${CREDS}"

echo "UV_INDEX_URL=https://${CREDS}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV"

echo "PIP_INDEX_URL=https://${CREDS}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV"