jfrog / jfrog/jfrog-cli-security
Switching to OIDC for Authentication forces advanced security
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 13
- Forks
- 50
- Avg merge
- 3d 48m
- Merged PRs (30d)
- 26
Description
Describe the bug
Hi there we have a fully working CI calling jf docker scan that works 100% when we call jf docker scan.
This is illustrated in the picture below:
However the very moment we switch to using OIDC authentication the exact same command with nothing else changed seems to force contextual analysis and advanced security features.
It is our expectation that this should work just as it did before when we pasted the first picture.
We are on both the latest artifactory and calling the latest version in setup-jfrog-cli.
Would you be able to advise on what our problem might be?
You can see the failed run here:
https://github.com/gccloudone/artifacts-artefacts/actions/runs/15421506707/job/43397544685
The workflow behind this failed run here:
Current behavior
N/A
Reproduction steps
N/A
Expected behavior
No response
JFrog CLI version
2.76.1
Operating system type and version
Linux
JFrog Artifactory version
Enterprise Plus 7.111.8 rev 81108900
JFrog Xray version
Enterprise Plus 7.111.8 rev 81108900
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with .github/workflows/java-app.yml and the linked failed GitHub Actions run, comparing the working authentication flow with the OIDC version of jf docker scan. Check the reported JFrog CLI 2.76.1, Artifactory, and Xray versions and determine why OIDC changes the scan behavior; done means the same scan no longer forces contextual analysis or advanced security features.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, go
- Domain
- authentication, ci-cd, cli, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100