jfrog / jfrog/jfrog-cli-security

Switching to OIDC for Authentication forces advanced security

Open
#497 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
Go
Stars
13
Forks
50
Avg merge
3d 48m
Merged PRs (30d)
26

Description

Describe the bug

Hi there we have a fully working CI calling jf docker scan that works 100% when we call jf docker scan.

This is illustrated in the picture below:

Image

However the very moment we switch to using OIDC authentication the exact same command with nothing else changed seems to force contextual analysis and advanced security features.

Image

It is our expectation that this should work just as it did before when we pasted the first picture.

We are on both the latest artifactory and calling the latest version in setup-jfrog-cli.

Would you be able to advise on what our problem might be?

You can see the failed run here:

https://github.com/gccloudone/artifacts-artefacts/actions/runs/15421506707/job/43397544685

The workflow behind this failed run here:

https://github.com/gccloudone/artifacts-artefacts/blob/feat/jfrog-oidc/.github/workflows/java-app.yml

Current behavior

N/A

Reproduction steps

N/A

Expected behavior

No response

JFrog CLI version

2.76.1

Operating system type and version

Linux

JFrog Artifactory version

Enterprise Plus 7.111.8 rev 81108900

JFrog Xray version

Enterprise Plus 7.111.8 rev 81108900

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with .github/workflows/java-app.yml and the linked failed GitHub Actions run, comparing the working authentication flow with the OIDC version of jf docker scan. Check the reported JFrog CLI 2.76.1, Artifactory, and Xray versions and determine why OIDC changes the scan behavior; done means the same scan no longer forces contextual analysis or advanced security features.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, go
Domain
authentication, ci-cd, cli, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.