jfrog / jfrog/setup-jfrog-cli

JFrog CLI Issue with OIDC Token Expiry

Open
#220 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

bug
Dominant language
TypeScript
Stars
266
Forks
110
Avg merge
3d 15h
Merged PRs (30d)
3

Description

Describe the bug

When using an OIDC token configured to expire after 1 minute in a GitHub action to download Maven jars and build a Docker image, the download fails with a 401 error ("Token failed verification expired"). The token expires before the process completes, causing an incomplete download.

Current behavior

The token expires in 1 minute, and JFrog CLI does not automatically refresh it, leading to a 401 error and incomplete downloads. Refer GitHub Action job# https://github.com/krishnamanchikalapudi/spring-petclinic/actions/runs/11005259480/job/30557614565

Screenshot 2024-09-23 at 6 37 29 PM
Reproduction steps
  1. Configure GitHub Integration:
  • Set the OIDC token expiration duration to 1 minute in Artifactory's GitHub integration.
  1. Run Maven Build:
  • Use the configured OIDC token in a GitHub Action to initiate a Maven build that requires downloading dependencies from Artifactory.
  1. Build Docker Image:
  • As part of the same workflow, attempt to build a Docker image that pulls from the Maven artifacts.
    Observe Issue:

The token expires before the process completes, resulting in a 401 error (Token failed verification: expired) and incomplete artifact download.

Expected behavior

The JFrog CLI should refresh the token upon expiration to ensure that the download completes without requiring a long-duration token.

Setup JFrog CLI version

jfrog/setup-jfrog-cli@v4

JFrog CLI version

2.67.0

Workflow operating system type and version

ubuntu:latest

JFrog Artifactory version (if relevant)

No response

JFrog Xray version (if relevant)

No response

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reviewing the setup-jfrog-cli@v4 action entry point and reproduce the linked GitHub Actions workflow with a one-minute OIDC token, Maven downloads, and the Docker build. Trace where the token is configured and verify that the workflow completes without the 401 expired-token error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions, typescript
Domain
authentication, ci-cd, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.