Introduction
It is supported to use the JFrog CLI in GitHub Actions to perform operations on Artifactory.
When connecting to Artifactory using OIDC with the JFrog CLI, refer to github-action-examples to set up your pipeline. You may encounter a 403 error during runtime. The detailed log is as follows:
Publish the build info to JFrog Artifactory
/opt/hostedtoolcache/jf/2.91.0/x64/jf rt build-publish
02:04:07 [Info] Publishing build info for <Java CI with Maven>/<12>...
{
"status": "failure",
"totals": {
"success": 0,
"failure": 1
},
"files": []
}
02:04:08 [Info] Trace ID for JFrog Platform logs: <trace_id>
Error: 8 [Error] server response: 403 Forbidden
{
"errors": [
{
"status": 403,
"message": "User token:*** is not permitted to deploy 'Java CI with Maven/xx-xxxx.json' into 'artifactory-build-info:Java CI with Maven/xx-xxxx.json'."
}
]
}
Warning: Failed while attempting to publish the build info to JFrog Artifactory: Error: JFrog CLI exited with exit code: 1
Root Cause
The JFrog CLI automatically generates Build Info and uploads it to the global artifactory-build-info repository. However, if the token configured in the OIDC identity mapping uses project rules, and the exchanged Artifactory access token has no permission on the global artifactory-build-info repository, it will report a 403 error. Instead, the Build Info should be automatically uploaded to the build info repository under your project.
Solution
To specify the project to apply to, add the environment variable JF_PROJECT: "project_name" to the pipeline's env. For example:
jobs:
oidc-test:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v3
- name: Setup JFrog CLI
id: setup-jfrog-cli
uses: jfrog/setup-jfrog-cli@v4
env:
JF_URL: https://<artifactory_url>
JF_PROJECT: "project_name"
Running the pipeline again will display that the Build Info has been successfully published to the project_name-build-info repository:
Build info successfully deployed. Browse is in Artifactory under https://<artifactory_url>/x/x/published?buildRepo=project_name-build-info&projectKey=project_name