JFrog CLI Issue with OIDC Token Expiry
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 266
- Forks
- 110
- Avg merge
- 3d 15h
- Merged PRs (30d)
- 3
Description
Describe the bug
When using an OIDC token configured to expire after 1 minute in a GitHub action to download Maven jars and build a Docker image, the download fails with a 401 error ("Token failed verification expired"). The token expires before the process completes, causing an incomplete download.
Current behavior
The token expires in 1 minute, and JFrog CLI does not automatically refresh it, leading to a 401 error and incomplete downloads. Refer GitHub Action job# https://github.com/krishnamanchikalapudi/spring-petclinic/actions/runs/11005259480/job/30557614565
Reproduction steps
- Configure GitHub Integration:
- Set the OIDC token expiration duration to 1 minute in Artifactory's GitHub integration.
- Run Maven Build:
- Use the configured OIDC token in a GitHub Action to initiate a Maven build that requires downloading dependencies from Artifactory.
- Build Docker Image:
- As part of the same workflow, attempt to build a Docker image that pulls from the Maven artifacts.
Observe Issue:
The token expires before the process completes, resulting in a 401 error (Token failed verification: expired) and incomplete artifact download.
Expected behavior
The JFrog CLI should refresh the token upon expiration to ensure that the download completes without requiring a long-duration token.
Setup JFrog CLI version
jfrog/setup-jfrog-cli@v4
JFrog CLI version
2.67.0
Workflow operating system type and version
ubuntu:latest
JFrog Artifactory version (if relevant)
No response
JFrog Xray version (if relevant)
No response
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reviewing the setup-jfrog-cli@v4 action entry point and reproduce the linked GitHub Actions workflow with a one-minute OIDC token, Maven downloads, and the Docker build. Trace where the token is configured and verify that the workflow completes without the 401 expired-token error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions, typescript
- Domain
- authentication, ci-cd, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100