oidcTests.yml

# These Tests validate successful OIDC server configuration in the CLI.
# After the server has been configured the CLI will ping the server to make sure we have access
name: "Config OIDC test"
on:
  push:
    branches:
      - '**'
    tags-ignore:
      - '**'
  # Triggers the workflow on labeled PRs only.
  pull_request_target:
    types: [ labeled ]
# Ensures that only the latest commit is running for each PR at a time.
concurrency:
  group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.sha }}-${{ github.ref }}
  cancel-in-progress: true

env:
  JFROG_CLI_LOG_LEVEL: DEBUG

# Needed for OIDC
permissions:
  id-token: write
  contents: read
jobs:
  config-oidc:
    if: contains(github.event.pull_request.labels.*.name, 'safe to test') || github.event_name == 'push'
    strategy:
      fail-fast: false
      matrix:
        os: [ ubuntu-latest, macos-latest, windows-latest ]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Setup Go with cache
        uses: jfrog/.github/actions/install-go-with-cache@main

      - name: Checkout the repository
        uses: actions/checkout@v4
        with:
          ref: ${{ github.event.pull_request.head.sha }}

      - name: Build CLI
        run: |
          if [ "$RUNNER_OS" == "Windows" ]; then
            ./build/build.bat
          else
            ./build/build.sh
          fi
        shell: bash

      - name: Get ID Token from GitHub
        shell: bash
        run: |
          ID_TOKEN=$(curl -sLS -H "User-Agent: actions/oidc-client" -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
          "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
          echo "JFROG_CLI_OIDC_EXCHANGE_TOKEN_ID=${ID_TOKEN}" >> $GITHUB_ENV

      - name: Run config command
        shell: bash
        run: |
          if [ "$RUNNER_OS" == "Windows" ]; then
            ./jfrog.exe c add --url=https://ecosysjfrog.jfrog.io --oidc-provider-name=setup-jfrog-cli-test --interactive=false
          else
            ./jf c add --url=https://ecosysjfrog.jfrog.io --oidc-provider-name=setup-jfrog-cli-test --interactive=false
          fi

      - name: Ping the server to validate successful OIDC configuration
        shell: bash
        run: |
          if [ "$RUNNER_OS" == "Windows" ]; then
            ./jfrog.exe rt ping
          else
           ./jf rt ping
          fi