jfrog-oidc-setup

Configure OpenID Connect integration between GitHub Actions and JFrog Platform.

5|1|Updated Mar 2, 2026

Search Tags:#authentication #github-actions #ci #oidc #provider-setup #identity-mapping #jfrog-platform

Ready to run

npx skills add https://github.com/jfrog/ai-agent-examples --skill jfrog-oidc-setup

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: jfrog-oidc-setup
Source: https://github.com/jfrog/ai-agent-examples/tree/main/onboarding-workflows/skills/jfrog-oidc-setup
Command: npx skills add https://github.com/jfrog/ai-agent-examples --skill jfrog-oidc-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Configures OpenID Connect (OIDC) integration between GitHub Actions and JFrog Platform, enabling secretless CI authentication for workflows.

Core Features & Use Cases

Automates OIDC provider setup and identity mappings across multiple repositories within a project.
Distinguishes between Public GitHub and GitHub Enterprise to select the correct issuer URLs and provider type.
Reuses existing providers when possible and creates new ones with the proper issuer_url and type.
Creates per-repo identity mappings for main branch deploy access and PR read-only access with appropriate priorities and scopes.
Enforces manifest-driven preferences and subscription checks to guard the activation of CI workflows.
Provides guidance on error handling and rollback strategies during the setup process.

Quick Start

In your manifest, enable OIDC (github.oidc_setup: true) and run the OIDC setup flow to configure providers and repository mappings.

Frequently Asked Questions about jfrog-oidc-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up secretless authentication between GitHub Actions and the JFrog Platform?▼

To configure secretless authentication between GitHub Actions and the JFrog Platform, you set up OpenID Connect (OIDC) integration. This involves creating an OIDC provider with the correct issuer URL and defining per-repository identity mappings for branch and PR access.

What is the difference between configuring OIDC for Public GitHub versus GitHub Enterprise?▼

OIDC configuration for Public GitHub and GitHub Enterprise differs by the issuer URL and provider type used. The setup process automatically distinguishes between the two platforms to select the correct issuer URL for your CI workflows.

How do I configure per-repository identity mappings for CI workflows?▼

Configuring per-repository identity mappings involves creating distinct access rules for each repository. The setup creates mappings for main branch deploy access and PR read-only access, applying appropriate priorities and scopes to secure your CI workflows.

Can I reuse an existing OIDC provider when setting up CI workflows across multiple repositories?▼

Yes, you can reuse an existing OIDC provider when setting up CI workflows across multiple repositories. The setup process reuses available providers when possible and only creates new ones if a matching provider with the proper issuer URL and type is absent.

Does OIDC setup for JFrog support manifest-driven gating and subscription checks?▼

Yes, OIDC setup for JFrog supports manifest-driven gating and subscription checks. It enforces manifest preferences and verifies subscription requirements to guard the activation of your CI workflows before applying provider and identity configurations.

What are the limitations or rollback strategies if GitHub Actions OIDC provider setup fails?▼

If GitHub Actions OIDC provider setup fails, limitations include potential misconfigured issuer URLs or subscription gating failures. The setup provides guidance on error handling and rollback strategies to revert provider creation and repository mappings during the process.