How do I use JFrog OIDC credentials to run a container in another job?
还没有人认领这个 Issue。
评估
- 难度
- 4/5
- 预计耗时
- 3-5 天
- 新手友好度
- 42/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- github-actions, typescript
- 领域
- authentication, ci-cd
调研方向
Start by reading src/oidc-utils.ts around the core.setSecret calls identified in the issue, and trace how the OIDC username and token become action outputs. Consider the interaction between secret masking and GitHub Actions job outputs before proposing a change. Done means the credentials can be passed to another job as described without compromising their handling.
由索引模型根据 Issue 内容生成。
描述
Describe the bug
Currently, it's not possible to obtain OIDC credentials and then use them to run code on a different container
Mainly because {{ steps.jfrog.outputs.oidc-user }} and {{ steps.jfrog.outputs.oidc-password }} are marked as secrets using
https://github.com/jfrog/setup-jfrog-cli/blob/v5.3.0/src/oidc-utils.ts#L159
core.setSecret(accessToken);
core.setSecret(username);
by forking the repo and removing this lines, I was successfully able to do this:
name: Run a Container Hosted In Jfrog
run-name: Run a Container Hosted In Jfrog
permissions:
contents: read
id-token: write
on:
workflow_dispatch:
jobs:
jfrog_auth:
name: "JFrog Authentication"
runs-on: default
outputs:
jfrog_username: ${{ steps.jfrog.outputs.oidc-user }}
jfrog_password: ${{ steps.jfrog.outputs.oidc-token }}
steps:
- name: Setup JFrog CLI (OIDC)
id: jfrog
uses: jfrog/setup-jfrog-cli@v5
with:
oidc-provider-name: MY_OIDC_PROVIDER_NAME
oidc-audience: MY_OIDC_AUDIENCE
env:
JF_URL: https://MYORG.jfrog.io
next_gen_web:
runs-on: default
needs: jfrog_auth
container:
image: MYORG.jfrog.io/MY_PATH/MY_CONTAINER:latest
credentials:
username: "${{ needs.jfrog_auth.outputs.jfrog_username }}"
password: "${{ needs.jfrog_auth.outputs.jfrog_password }}"
steps:
- run: |
echo "This is running from inside of MYORG.jfrog.io/MY_PATH/MY_CONTAINER:latest"
Current behavior
oidc-user and oidc-password can not be transmitted between jobs
Reproduction steps
the code above
Expected behavior
the code above should work
Setup JFrog CLI version
jfrog/setup-jfrog-cli@v5
JFrog CLI version
none
Workflow operating system type and version
github actions
JFrog Artifactory version (if relevant)
No response
JFrog Xray version (if relevant)
No response
- 主要语言
- TypeScript
- 星标
- 268
- 派生
- 113
- 平均合并
- 13 分钟
- 30 天内合并 PR
- 5
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
jfrog/setup-jfrog-cli 的其他 Issue
-
bug
难度 3/5 1-2 天 新手友好度 58/100
jfrog/setup-jfrog-cli#349 ·
-
feature request
难度 4/5 3-5 天 新手友好度 55/100
jfrog/setup-jfrog-cli#348 ·
-
bug
难度 5/5 一周以上 新手友好度 35/100
jfrog/setup-jfrog-cli#347 · 1 条评论 ·
-
`enable-package-alias: true` installs the alias but never activates it (`JFROG_CLI_GHOST_FROG` is never set)可能已有人在做 @amarkdotdev 于 69 天前认领。 未关闭
难度 3/5 1-2 天 新手友好度 68/100
jfrog/setup-jfrog-cli#343 · 1 个 reaction ·
-
Cleanup is not running on self-hosted runners when using server config可能已有人在做 @omribz156 于 152 天前认领。 未关闭bug
难度 3/5 1-2 天 新手友好度 67/100
jfrog/setup-jfrog-cli#339 ·
查看 jfrog/setup-jfrog-cli 的全部 Issue
相似的 Issue
-
ready
难度 2/5 1-3 小时 新手友好度 63/100
wheresrhys/totf#1214 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
CodeChefVIT/ffcs#281 ·
维护者通常 2 天内回复
-
难度 2/5 1-3 小时 新手友好度 82/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 83/100
endora-commerce/endora-commerce#451 ·
维护者通常 1 天内回复
-
enhancement
难度 2/5 1-3 小时 新手友好度 65/100
vetro-protocol/vetro-monorepo#1007 ·
维护者通常 1 天内回复