jfrog-oidc-setup

JFrog OIDC Setup

Prefer jf api per ../../../platform-features/skills/jfrog-cli/jf-api-patterns.md for JFrog REST calls; curl in examples is fallback when the CLI is unavailable.

Configures OpenID Connect (OIDC) integration between GitHub Actions and JFrog Platform, enabling secretless authentication for CI workflows.

Overview

OIDC allows GitHub Actions workflows to authenticate with JFrog without storing long-lived secrets. GitHub issues short-lived tokens that JFrog validates and exchanges for access.

GitHub Actions  -->  GitHub OIDC Provider  -->  JFrog Platform
     |                      |                        |
     | 1. Request token     |                        |
     |--------------------->|                        |
     |                      |                        |
     | 2. JWT token         |                        |
     |<---------------------|                        |
     |                      |                        |
     | 3. Present JWT       |                        |
     |---------------------------------------------->|
     |                      |                        |
     |                      |    4. Validate & grant |
     |<----------------------------------------------|

Inputs

• project_key -- JFrog project key
• github_repos -- list of owner/repo (e.g., ["myorg/my-app", "myorg/my-lib"])
• github_host -- GitHub host (e.g., github.com or github.mycompany.com)
• OIDC_SETUP -- boolean from manifest github.oidc_setup key (user's preference)
• OIDC_AVAILABLE -- boolean from prerequisite subscription check

Step 0: Check OIDC Setup Preference and Availability

First, check the user's preference from the manifest (OIDC_SETUP). Then verify platform support (OIDC_AVAILABLE).

If OIDC_SETUP is false: skip the entire skill regardless of subscription and return:

• oidc_provider_name = empty string
• Log: INFO: OIDC setup is disabled in manifest (github.oidc_setup: false). CI workflows will use secrets-based authentication.