Update JFrog GitHub OIDC setup docs #37596

EyalDelarea · 2025-04-17T12:32:02Z

Why:

This change updates the JFrog OIDC integration guide to reflect a recent improvement in the jfrog/setup-jfrog-cli GitHub Action. The action now supports seamless OIDC authentication out of the box, removing the need for users to manually exchange tokens via REST API calls.

What's being changed (if available, include any code snippets, screenshots, or gifs):

Removed outdated examples that manually exchange the GitHub OIDC token using curl.
Added a simplified and secure example using jfrog/setup-jfrog-cli@v4 with oidc-provider-name and oidc-audience inputs.
Clarified that no manual token exchange is required when using the JFrog CLI.
Added a permissions block (id-token: write) to the YAML example to ensure OIDC works as expected.
Included a new “Security Best Practices” section and a “Further Reading” section linking to the JFrog CLI’s manual token exchange command for advanced use cases.

Check off the following:

A subject matter expert (SME) has reviewed the technical accuracy of the content in this PR.
The changes in this PR meet [the docs fundamentals that are required for all content](http://docs.github.com/en/contributing/writing-for-github-docs/about-githubs-documentation-fundamentals).
All CI checks are passing and the changes look good in the review environment.

welcome · 2025-04-17T12:32:04Z

Thanks for opening this pull request! A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

github-actions · 2025-04-17T12:32:32Z

How to review these changes 👓

Thank you for your contribution. To review these changes, choose one of the following options:

A Hubber will need to deploy your changes internally to review.

Table of review links

Note: Please update the URL for your staging server or codespace.

The table shows the files in the content directory that were changed in this pull request. This helps you review your changes on a staging server. Changes to the data directory are not included in this table.

Source	Review	Production	What Changed
`actions/security-for-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md`	fpt ghec	fpt ghec

Key: fpt: Free, Pro, Team; ghec: GitHub Enterprise Cloud; ghes: GitHub Enterprise Server

🤖 This comment is automatically generated.

… into update_jfrog_docs

…og_docs

Sharra-writes · 2025-04-17T23:05:44Z

@EyalDelarea Thanks for opening a PR! 🎉

It looks like this is still a draft. Could you ping me when this is ready? Then, I'll get it up for review ⚡

MikaLJF

It looks great! I left a couple comments, please take a look and let me know what you think

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

…og_docs

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

Sharra-writes · 2025-04-21T22:11:05Z

Thanks! I'll get this triaged now.

github-actions · 2025-04-21T22:12:48Z

Thanks for opening a pull request! We've triaged this issue for technical review by a subject matter expert 👀

EyalDelarea · 2025-04-22T06:56:46Z

Hey @Sharra-writes,
We want to introduce a new change to our setup-jfrog-cli and only then merge this PR.
So let me know if you want me to move this to draft again,
The content will be the same.
Thanks !

Sharra-writes · 2025-04-22T21:01:12Z

@EyalDelarea If this isn't ready to merge yet, then leaving it as a draft would probably be better. My job will be looking for technical confirmation internally, and I probably can't get confirmation on changes that haven't been made yet! 😆

EyalDelarea · 2025-04-23T06:59:27Z

@Sharra-writes,
I've converted it to draft for now, will ping once it's ready for review.
Thank you.

…og_docs

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

…og_docs

EyalDelarea · 2025-05-05T14:36:04Z

Hey @Sharra-writes.

The PR is ready for review 👍

Sharra-writes · 2025-05-05T16:55:50Z

@EyalDelarea Thanks! I'll start looking for an SME to review. 👍

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

… into update_jfrog_docs

subatoi

👋 Thank you for raising this and thanks for your patience

I've raised a few comments and questions, and once we've resolved things there won't be any problem with merging this. With a couple of exceptions, almost all of my review comments are related to the GitHub or Microsoft style guides, so if you'd like us to explain any of them then just let us know. Thank you

subatoi · 2025-05-29T08:51:34Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md


+### Example: Using OIDC Credentials in Other Steps


Suggested change

### Example: Using OIDC Credentials in Other Steps

### Using OIDC Credentials in other steps

subatoi · 2025-05-29T08:51:42Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

+          password: ${{ steps.setup-jfrog-cli.outputs.oidc-token }}
+```
+
+## Further Reading


Suggested change

## Further Reading

## Further reading

subatoi · 2025-05-29T08:52:10Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

+
+## Further Reading
+
+- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)


Suggested change

- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)

- [OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration) in the JFrog documentation

subatoi · 2025-05-29T08:52:37Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

+## Further Reading
+
+- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)
+- [Configure Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings)


Suggested change

- [Configure Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings)

- [Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings) in the JFrog documentation

subatoi · 2025-05-29T08:52:54Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

+
+- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)
+- [Configure Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings)
+- [GitHub Docs: About Security Hardening with OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)


Suggested change

- [GitHub Docs: About Security Hardening with OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)

- [AUTOTITLE](actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)

subatoi · 2025-05-29T08:55:00Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

@@ -47,59 +47,52 @@ To use OIDC with JFrog, establish a trust relationship between {% data variables

 ## Updating your {% data variables.product.prodname_actions %} workflow

-Once you establish a trust relationship between {% data variables.product.prodname_actions %} and the JFrog platform, you can update your {% data variables.product.prodname_actions %} workflow file.
+### Example: Authenticating with JFrog using OIDC


Suggested change

### Example: Authenticating with JFrog using OIDC

### Authenticating with JFrog using OIDC

subatoi · 2025-05-29T09:03:37Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

-    env:
-      OIDC_AUDIENCE: 'YOUR_AUDIENCE'
+    steps:
+      - name: Setup JFrog CLI with OIDC


Suggested change

- name: Setup JFrog CLI with OIDC

- name: Set up JFrog CLI with OIDC

subatoi · 2025-05-29T09:03:56Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

+> [!TIP]
+> When OIDC authentication is used, the `setup-jfrog-cli` action automatically provides `oidc-user` and `oidc-token` as step outputs.
+> These can be used for other integrations that require authentication with JFrog.
+> To reference these outputs, ensure the step has an explicit `id` defined (e.g., `id: setup-jfrog-cli`).


Suggested change

> To reference these outputs, ensure the step has an explicit `id` defined (e.g., `id: setup-jfrog-cli`).

> To reference these outputs, ensure the step has an explicit `id` defined (for example `id: setup-jfrog-cli`).

subatoi · 2025-05-29T09:05:35Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md


+### Example: Using OIDC Credentials in Other Steps


Is there a bit of extra context you could add here, just to set the scene for the example?

subatoi · 2025-05-29T09:06:28Z

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md

@@ -47,59 +47,52 @@ To use OIDC with JFrog, establish a trust relationship between {% data variables

 ## Updating your {% data variables.product.prodname_actions %} workflow

-Once you establish a trust relationship between {% data variables.product.prodname_actions %} and the JFrog platform, you can update your {% data variables.product.prodname_actions %} workflow file.


Is this information not accurate any more? It seems to add a nice bridge between the H2 and the H3

Update JFrog GitHub OIDC setup docs

8c8514c

github-actions bot added the triage Do not begin working on this issue until triaged by the team label Apr 17, 2025

EyalDelarea added 5 commits April 17, 2025 15:34

Merge branch 'main' into update_jfrog_docs

8aca661

Remove note section

7c0f732

Merge branch 'update_jfrog_docs' of https://github.com/EyalDelarea/docs…

b6e661d

… into update_jfrog_docs

Merge branch 'main' of https://github.com/github/docs into update_jfr…

d295d1a

…og_docs

Fix diff

9c67e23

MikaLJF reviewed Apr 20, 2025

View reviewed changes

EyalDelarea added 3 commits April 20, 2025 13:19

CR

adb9081

Merge branch 'main' of https://github.com/github/docs into update_jfr…

5152bae

…og_docs

Remove unused variable

9246dee

MikaLJF reviewed Apr 20, 2025

View reviewed changes

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md Outdated Show resolved Hide resolved

Update

48859cf

EyalDelarea marked this pull request as ready for review April 21, 2025 06:24

Milanhe92 mentioned this pull request Apr 21, 2025

fix: remove duplicate line about actions #37643

Merged

3 tasks

Sharra-writes added content This issue or pull request belongs to the Docs Content team needs SME This proposal needs review from a subject matter expert and removed triage Do not begin working on this issue until triaged by the team labels Apr 21, 2025

EyalDelarea marked this pull request as draft April 23, 2025 06:58

EyalDelarea added 3 commits April 24, 2025 14:29

Update

a1ca515

Update

ed8ab47

Remove unneeded link

1d1b453

EyalDelarea added 2 commits April 27, 2025 16:16

Merge branch 'main' of https://github.com/github/docs into update_jfr…

25123d1

…og_docs

Update

554c351

MikaLJF reviewed Apr 29, 2025

View reviewed changes

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md Show resolved Hide resolved

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md Show resolved Hide resolved

EyalDelarea added 3 commits May 4, 2025 13:25

Merge branch 'main' of https://github.com/github/docs into update_jfr…

c219ce1

…og_docs

Remove the security section

33afa50

Update

2162642

EyalDelarea marked this pull request as ready for review May 5, 2025 14:35

Merge branch 'main' into update_jfrog_docs

14c5fee

Merge branch 'main' into update_jfrog_docs

9554cc2

zarenner reviewed May 12, 2025

View reviewed changes

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md Outdated Show resolved Hide resolved

zarenner reviewed May 12, 2025

View reviewed changes

...or-github-actions/security-hardening-your-deployments/configuring-openid-connect-in-jfrog.md Outdated Show resolved Hide resolved

EyalDelarea added 2 commits May 12, 2025 15:05

CR

6ff7f79

Merge branch 'update_jfrog_docs' of https://github.com/EyalDelarea/docs…

b855d02

… into update_jfrog_docs

zarenner approved these changes May 12, 2025

View reviewed changes

Merge branch 'main' into update_jfrog_docs

3126895

Sharra-writes added waiting for review Issue/PR is waiting for a writer's review SME reviewed An SME has reviewed this issue/PR and removed needs SME This proposal needs review from a subject matter expert labels May 12, 2025

EyalDelarea and others added 8 commits May 13, 2025 08:41

Merge branch 'main' into update_jfrog_docs

970249b

Merge branch 'main' into update_jfrog_docs

e3cba36

Merge branch 'main' into update_jfrog_docs

01a424a

Merge branch 'main' into update_jfrog_docs

43a087d

Merge branch 'main' into update_jfrog_docs

fe5153a

Merge branch 'main' into update_jfrog_docs

b2d7317

Merge branch 'main' into update_jfrog_docs

285c775

Merge branch 'main' into update_jfrog_docs

0398058

subatoi reviewed May 29, 2025

View reviewed changes

	### Example: Using OIDC Credentials in Other Steps
	### Using OIDC Credentials in other steps


		## Further Reading

		- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)

	- [JFrog OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration)
	- [OpenID Connect Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration) in the JFrog documentation

	- [Configure Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings)
	- [Identity Mappings](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings) in the JFrog documentation

	- [GitHub Docs: About Security Hardening with OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)
	- [AUTOTITLE](actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)

	### Example: Authenticating with JFrog using OIDC
	### Authenticating with JFrog using OIDC

	- name: Setup JFrog CLI with OIDC
	- name: Set up JFrog CLI with OIDC

	> To reference these outputs, ensure the step has an explicit `id` defined (e.g., `id: setup-jfrog-cli`).
	> To reference these outputs, ensure the step has an explicit `id` defined (for example `id: setup-jfrog-cli`).

		@@ -47,59 +47,52 @@ To use OIDC with JFrog, establish a trust relationship between {% data variables

		## Updating your {% data variables.product.prodname_actions %} workflow

		Once you establish a trust relationship between {% data variables.product.prodname_actions %} and the JFrog platform, you can update your {% data variables.product.prodname_actions %} workflow file.

Update JFrog GitHub OIDC setup docs #37596

Are you sure you want to change the base?

Update JFrog GitHub OIDC setup docs #37596

Uh oh!

Conversation

EyalDelarea commented Apr 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why:

What's being changed (if available, include any code snippets, screenshots, or gifs):

Check off the following:

Uh oh!

welcome bot commented Apr 17, 2025

Uh oh!

github-actions bot commented Apr 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

How to review these changes 👓

Uh oh!

Sharra-writes commented Apr 17, 2025

Uh oh!

MikaLJF left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Sharra-writes commented Apr 21, 2025

Uh oh!

github-actions bot commented Apr 21, 2025

Uh oh!

EyalDelarea commented Apr 22, 2025

Uh oh!

Sharra-writes commented Apr 22, 2025

Uh oh!

EyalDelarea commented Apr 23, 2025

Uh oh!

Uh oh!

Uh oh!

EyalDelarea commented May 5, 2025

Uh oh!

Sharra-writes commented May 5, 2025

Uh oh!

Uh oh!

Uh oh!

subatoi left a comment

Choose a reason for hiding this comment

Uh oh!

subatoi May 29, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

EyalDelarea commented Apr 17, 2025 •

edited

Loading

github-actions bot commented Apr 17, 2025 •

edited

Loading

subatoi May 29, 2025 •

edited

Loading