Skip to content

Commit c55e35d

Browse files
EyalDelareaEyalDelarea
authored
Export OIDC vcs params (#297)
1 parent 810aca0 commit c55e35d

File tree

4 files changed

+50
-15
lines changed

4 files changed

+50
-15
lines changed

‎lib/oidc-utils.js‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -222,6 +222,16 @@ class OidcUtils {
222222
core.exportVariable('JFROG_CLI_USAGE_CONFIG_OIDC', 'TRUE');
223223
core.exportVariable('JFROG_CLI_USAGE_OIDC_USED', 'TRUE');
224224
}
225+
/**
226+
* Constructs the payload for the OIDC token exchange request.
227+
* NOTE: This structure is intended for legacy CLI versions and matches the access API format.
228+
* The payload includes a context object and some duplicated parameters for backward compatibility.
229+
* Future updates will move all additional parameters into the context object.
230+
* @param jwt
231+
* @param providerName
232+
* @param applicationKey
233+
* @private
234+
*/
225235
static buildOidcTokenExchangePayload(jwt, providerName, applicationKey) {
226236
var _a, _b, _c, _d, _e, _f, _g, _h;
227237
return {
@@ -230,26 +240,24 @@ class OidcUtils {
230240
subject_token: jwt,
231241
provider_name: providerName,
232242
project_key: (_a = process.env.JF_PROJECT) !== null && _a !== void 0 ? _a : '',
243+
// gh_* params are used for usage tracking
233244
gh_job_id: (_b = process.env.GITHUB_JOB) !== null && _b !== void 0 ? _b : '',
234245
gh_run_id: (_c = process.env.GITHUB_RUN_ID) !== null && _c !== void 0 ? _c : '',
235246
gh_repo: (_d = process.env.GITHUB_REPOSITORY) !== null && _d !== void 0 ? _d : '',
236247
gh_revision: (_e = process.env.GITHUB_SHA) !== null && _e !== void 0 ? _e : '',
237248
gh_branch: (_f = process.env.GITHUB_REF_NAME) !== null && _f !== void 0 ? _f : '',
238249
application_key: applicationKey,
250+
// This object is planned to be expanded as needed
251+
// even though currently it contains some duplicated parameters
239252
context: {
240253
vcs_commit: {
241-
vcs_url: this.buildVcsUrl(),
254+
vcs_url: utils_1.Utils.buildVcsUrl(),
242255
branch: (_g = process.env.GITHUB_REF_NAME) !== null && _g !== void 0 ? _g : '',
243256
revision: (_h = process.env.GITHUB_SHA) !== null && _h !== void 0 ? _h : '',
244257
},
245258
},
246259
};
247260
}
248-
static buildVcsUrl() {
249-
const serverUrl = process.env.GITHUB_SERVER_URL;
250-
const repo = process.env.GITHUB_REPOSITORY;
251-
return serverUrl && repo ? `${serverUrl}/${repo}` : '';
252-
}
253261
/**
254262
* Retrieves the application key from .jfrog/config file.
255263
*

‎lib/utils.js‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,7 +245,7 @@ class Utils {
245245
return Utils.SETUP_JFROG_CLI_SERVER_ID;
246246
}
247247
static setCliEnv() {
248-
var _a, _b, _c, _d, _e;
248+
var _a, _b, _c, _d, _e, _f, _g, _h, _j;
249249
if (core.isDebug()) {
250250
Utils.exportVariableIfNotSet('JFROG_CLI_LOG_LEVEL', 'DEBUG');
251251
}
@@ -256,6 +256,10 @@ class Utils {
256256
Utils.exportVariableIfNotSet('JFROG_CLI_CI_JOB_ID', (_b = process.env.GITHUB_WORKFLOW) !== null && _b !== void 0 ? _b : '');
257257
Utils.exportVariableIfNotSet('JFROG_CLI_CI_RUN_ID', (_c = process.env.GITHUB_RUN_ID) !== null && _c !== void 0 ? _c : '');
258258
Utils.exportVariableIfNotSet('JFROG_CLI_GITHUB_TOKEN', (_d = process.env.GITHUB_TOKEN) !== null && _d !== void 0 ? _d : '');
259+
// Used for OIDC token exchange extra params
260+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_VCS_REVISION', (_f = (_e = process.env.GITHUB_SHA) !== null && _e !== void 0 ? _e : '') !== null && _f !== void 0 ? _f : '');
261+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_BRANCH', (_h = (_g = process.env.GITHUB_REF_NAME) !== null && _g !== void 0 ? _g : '') !== null && _h !== void 0 ? _h : '');
262+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_VCS_URL', Utils.buildVcsUrl());
259263
let buildNameEnv = process.env.GITHUB_WORKFLOW;
260264
if (buildNameEnv) {
261265
Utils.exportVariableIfNotSet('JFROG_CLI_BUILD_NAME', buildNameEnv);
@@ -276,7 +280,12 @@ class Utils {
276280
job_summary_1.JobSummary.enableJobSummaries();
277281
}
278282
// Indicate if JF_GIT_TOKEN is provided as an environment variable, used by Xray usage.
279-
Utils.exportVariableIfNotSet('JFROG_CLI_USAGE_GH_TOKEN_FOR_CODE_SCANNING_ALERTS_PROVIDED', (_e = process.env.JF_GIT_TOKEN) !== null && _e !== void 0 ? _e : '');
283+
Utils.exportVariableIfNotSet('JFROG_CLI_USAGE_GH_TOKEN_FOR_CODE_SCANNING_ALERTS_PROVIDED', (_j = process.env.JF_GIT_TOKEN) !== null && _j !== void 0 ? _j : '');
284+
}
285+
static buildVcsUrl() {
286+
const serverUrl = process.env.GITHUB_SERVER_URL;
287+
const repo = process.env.GITHUB_REPOSITORY;
288+
return serverUrl && repo ? `${serverUrl}/${repo}` : '';
280289
}
281290
static exportVariableIfNotSet(key, value) {
282291
if (!process.env[key]) {

‎src/oidc-utils.ts‎

Lines changed: 14 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -211,35 +211,42 @@ export class OidcUtils {
211211
core.exportVariable('JFROG_CLI_USAGE_OIDC_USED', 'TRUE');
212212
}
213213

214+
/**
215+
* Constructs the payload for the OIDC token exchange request.
216+
* NOTE: This structure is intended for legacy CLI versions and matches the access API format.
217+
* The payload includes a context object and some duplicated parameters for backward compatibility.
218+
* Future updates will move all additional parameters into the context object.
219+
* @param jwt
220+
* @param providerName
221+
* @param applicationKey
222+
* @private
223+
*/
214224
private static buildOidcTokenExchangePayload(jwt: string, providerName: string, applicationKey: string): Record<string, any> {
215225
return {
216226
grant_type: 'urn:ietf:params:oauth:grant-type:token-exchange',
217227
subject_token_type: 'urn:ietf:params:oauth:token-type:id_token',
218228
subject_token: jwt,
219229
provider_name: providerName,
220230
project_key: process.env.JF_PROJECT ?? '',
231+
// gh_* params are used for usage tracking
221232
gh_job_id: process.env.GITHUB_JOB ?? '',
222233
gh_run_id: process.env.GITHUB_RUN_ID ?? '',
223234
gh_repo: process.env.GITHUB_REPOSITORY ?? '',
224235
gh_revision: process.env.GITHUB_SHA ?? '',
225236
gh_branch: process.env.GITHUB_REF_NAME ?? '',
226237
application_key: applicationKey,
238+
// This object is planned to be expanded as needed
239+
// even though currently it contains some duplicated parameters
227240
context: {
228241
vcs_commit: {
229-
vcs_url: this.buildVcsUrl(),
242+
vcs_url: Utils.buildVcsUrl(),
230243
branch: process.env.GITHUB_REF_NAME ?? '',
231244
revision: process.env.GITHUB_SHA ?? '',
232245
},
233246
},
234247
};
235248
}
236249

237-
private static buildVcsUrl(): string {
238-
const serverUrl: string | undefined = process.env.GITHUB_SERVER_URL;
239-
const repo: string | undefined = process.env.GITHUB_REPOSITORY;
240-
return serverUrl && repo ? `${serverUrl}/${repo}` : '';
241-
}
242-
243250
/**
244251
* Retrieves the application key from .jfrog/config file.
245252
*

‎src/utils.ts‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -287,6 +287,11 @@ export class Utils {
287287
Utils.exportVariableIfNotSet('JFROG_CLI_CI_RUN_ID', process.env.GITHUB_RUN_ID ?? '');
288288
Utils.exportVariableIfNotSet('JFROG_CLI_GITHUB_TOKEN', process.env.GITHUB_TOKEN ?? '');
289289

290+
// Used for OIDC token exchange extra params
291+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_VCS_REVISION', process.env.GITHUB_SHA ?? '' ?? '');
292+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_BRANCH', process.env.GITHUB_REF_NAME ?? '' ?? '');
293+
Utils.exportVariableIfNotSet('JFROG_CLI_CI_VCS_URL', Utils.buildVcsUrl());
294+
290295
let buildNameEnv: string | undefined = process.env.GITHUB_WORKFLOW;
291296
if (buildNameEnv) {
292297
Utils.exportVariableIfNotSet('JFROG_CLI_BUILD_NAME', buildNameEnv);
@@ -316,6 +321,12 @@ export class Utils {
316321
Utils.exportVariableIfNotSet('JFROG_CLI_USAGE_GH_TOKEN_FOR_CODE_SCANNING_ALERTS_PROVIDED', process.env.JF_GIT_TOKEN ?? '');
317322
}
318323

324+
public static buildVcsUrl(): string {
325+
const serverUrl: string | undefined = process.env.GITHUB_SERVER_URL;
326+
const repo: string | undefined = process.env.GITHUB_REPOSITORY;
327+
return serverUrl && repo ? `${serverUrl}/${repo}` : '';
328+
}
329+
319330
public static exportVariableIfNotSet(key: string, value: string) {
320331
if (!process.env[key]) {
321332
core.exportVariable(key, value);

0 commit comments

Comments
 (0)