jfrog-oidc-setup

To configure secretless authentication between GitHub Actions and the JFrog Platform, you set up OpenID Connect (OIDC) integration. This involves creating an OIDC provider with the correct issuer URL and defining per-repository identity mappings for branch and PR access.

OIDC configuration for Public GitHub and GitHub Enterprise differs by the issuer URL and provider type used. The setup process automatically distinguishes between the two platforms to select the correct issuer URL for your CI workflows.

Configuring per-repository identity mappings involves creating distinct access rules for each repository. The setup creates mappings for main branch deploy access and PR read-only access, applying appropriate priorities and scopes to secure your CI workflows.

Yes, you can reuse an existing OIDC provider when setting up CI workflows across multiple repositories. The setup process reuses available providers when possible and only creates new ones if a matching provider with the proper issuer URL and type is absent.

Yes, OIDC setup for JFrog supports manifest-driven gating and subscription checks. It enforces manifest preferences and verifies subscription requirements to guard the activation of your CI workflows before applying provider and identity configurations.

If GitHub Actions OIDC provider setup fails, limitations include potential misconfigured issuer URLs or subscription gating failures. The setup provides guidance on error handling and rollback strategies to revert provider creation and repository mappings during the process.