Skip to content

Commit fe08487

Browse files
pkosiecpkosiec
authored
ci: configure JFrog npm registry proxy for GitHub Actions, replace conventional commits PR checker (#233)
* chore(ci): configure JFrog npm registry proxy for GitHub Actions Add a composite action (.github/actions/setup-jfrog-npm) that handles OIDC token exchange with JFrog and configures npm to use the Artifactory proxy. This is required per go/hardened-gha to protect against supply chain attacks on public registries. Applied to all workflow jobs that install npm packages: - ci.yml (5 jobs) - docs-deploy.yml (build job) - release.yml (release + sync-template jobs) - release-lakebase.yml (release job) Signed-off-by: Pawel Kosiec <pawel.kosiec@databricks.com> * fix(ci): move JFrog npm setup before pnpm/action-setup pnpm/action-setup fetches pnpm from registry.npmjs.org, which is blocked on hardened runners. Move JFrog config earlier so the registry proxy is configured before any npm access. Signed-off-by: Pawel Kosiec <pawel.kosiec@databricks.com> * chore(ci): replace Docker-based PR title check with JS-based action Replace ytanikin/pr-conventional-commits (Docker-based, builds at runtime with npm ci) with amannn/action-semantic-pull-request (JS-based, pre-bundled). The Docker action fails on hardened runners because npm ci inside the container can't reach registry.npmjs.org. Signed-off-by: Pawel Kosiec <pawel.kosiec@databricks.com> --------- Signed-off-by: Pawel Kosiec <pawel.kosiec@databricks.com>
1 parent 431525a commit fe08487

6 files changed

Lines changed: 84 additions & 3 deletions

File tree

‎.github/actions/setup-jfrog-npm/action.yml‎

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,42 @@
1+
name: 'Setup JFrog npm registry'
2+
description: 'Obtains a JFrog OIDC token and configures npm to use the JFrog Artifactory proxy'
3+
inputs:
4+
npmrc-path:
5+
description: 'Path to write .npmrc file (use .npmrc for project-level override)'
6+
required: false
7+
default: '~/.npmrc'
8+
runs:
9+
using: 'composite'
10+
steps:
11+
- name: Get JFrog OIDC token
12+
shell: bash
13+
run: |
14+
set -euo pipefail
15+
ID_TOKEN=$(curl -sLS \
16+
-H "User-Agent: actions/oidc-client" \
17+
-H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
18+
"${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
19+
echo "::add-mask::${ID_TOKEN}"
20+
ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \
21+
"https://databricks.jfrog.io/access/api/v1/oidc/token" \
22+
-d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"')
23+
echo "::add-mask::${ACCESS_TOKEN}"
24+
if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
25+
echo "FAIL: Could not extract JFrog access token"
26+
exit 1
27+
fi
28+
echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"
29+
echo "JFrog OIDC token obtained successfully"
30+
31+
- name: Configure npm
32+
shell: bash
33+
run: |
34+
set -euo pipefail
35+
NPMRC_PATH="${{ inputs.npmrc-path }}"
36+
NPMRC_PATH="${NPMRC_PATH/#\~/$HOME}"
37+
cat > "$NPMRC_PATH" << EOF
38+
registry=https://databricks.jfrog.io/artifactory/api/npm/db-npm/
39+
//databricks.jfrog.io/artifactory/api/npm/db-npm/:_authToken=${JFROG_ACCESS_TOKEN}
40+
always-auth=true
41+
EOF
42+
echo "npm configured to use JFrog registry (wrote to $NPMRC_PATH)"

‎.github/workflows/ci.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,7 @@ concurrency:
1111
permissions:
1212
contents: read
1313
pull-requests: read
14+
id-token: write
1415

1516
jobs:
1617
detect-changes:
@@ -42,6 +43,8 @@ jobs:
4243

4344
steps:
4445
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
46+
- name: Setup JFrog npm
47+
uses: ./.github/actions/setup-jfrog-npm
4548
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
4649
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
4750
with:
@@ -80,6 +83,8 @@ jobs:
8083

8184
steps:
8285
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
86+
- name: Setup JFrog npm
87+
uses: ./.github/actions/setup-jfrog-npm
8388
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
8489
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
8590
with:
@@ -100,6 +105,8 @@ jobs:
100105

101106
steps:
102107
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
108+
- name: Setup JFrog npm
109+
uses: ./.github/actions/setup-jfrog-npm
103110
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
104111
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
105112
with:
@@ -128,6 +135,8 @@ jobs:
128135

129136
steps:
130137
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
138+
- name: Setup JFrog npm
139+
uses: ./.github/actions/setup-jfrog-npm
131140
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
132141
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
133142
with:
@@ -177,6 +186,8 @@ jobs:
177186

178187
steps:
179188
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
189+
- name: Setup JFrog npm
190+
uses: ./.github/actions/setup-jfrog-npm
180191
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
181192
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
182193
with:

‎.github/workflows/docs-deploy.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,8 @@ jobs:
2525
name: Build Docs
2626
steps:
2727
- uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
28+
- name: Setup JFrog npm
29+
uses: ./.github/actions/setup-jfrog-npm
2830
- uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
2931
- uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
3032
with:

‎.github/workflows/pr-title.yml‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,19 @@ jobs:
1818
name: Conventional Commit Title
1919
steps:
2020
- name: Validate PR title
21-
uses: ytanikin/pr-conventional-commits@fda730cb152c05a849d6d84325e50c6182d9d1e9 # 1.5.1
21+
uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
22+
env:
23+
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
2224
with:
23-
task_types: '["feat","fix","docs","test","ci","refactor","perf","chore","revert","style","build"]'
24-
add_label: 'false'
25+
types: |
26+
feat
27+
fix
28+
docs
29+
test
30+
ci
31+
refactor
32+
perf
33+
chore
34+
revert
35+
style
36+
build

‎.github/workflows/release-lakebase.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ jobs:
4545
git config user.name "github-actions[bot]"
4646
git config user.email "github-actions[bot]@users.noreply.github.com"
4747
48+
- name: Setup JFrog npm
49+
uses: ./.github/actions/setup-jfrog-npm
50+
with:
51+
npmrc-path: .npmrc
52+
4853
- name: Setup pnpm
4954
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
5055

‎.github/workflows/release.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ jobs:
4545
git config user.name "github-actions[bot]"
4646
git config user.email "github-actions[bot]@users.noreply.github.com"
4747
48+
- name: Setup JFrog npm
49+
uses: ./.github/actions/setup-jfrog-npm
50+
with:
51+
npmrc-path: .npmrc
52+
4853
- name: Setup pnpm
4954
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
5055

@@ -103,6 +108,7 @@ jobs:
103108

104109
permissions:
105110
contents: write
111+
id-token: write
106112

107113
steps:
108114
- name: Checkout
@@ -117,6 +123,9 @@ jobs:
117123
git config user.name "github-actions[bot]"
118124
git config user.email "github-actions[bot]@users.noreply.github.com"
119125
126+
- name: Setup JFrog npm
127+
uses: ./.github/actions/setup-jfrog-npm
128+
120129
- name: Setup pnpm
121130
uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
122131

0 commit comments

Comments
 (0)