GitHub Actions

The Setup JFrog CLI action installs and configures JFrog CLI for a GitHub Actions job. Use it to resolve and publish packages through JFrog Artifactory and attach artifacts, dependencies, environment data, and Git metadata to build information.

This topic covers the following tasks:

• Quick Start
• Use OIDC Instead of a Stored Token
• Publish Package Build Information

Prerequisites

• A GitHub repository where you can add a workflow and repository secrets or variables.
• A JFrog Platform URL stored as the non-secret GitHub variable JF_URL.
• One authentication method:
  • An access token stored as JF_ACCESS_TOKEN.
  • JF_USER and JF_PASSWORD.
  • A JFrog OIDC integration and identity mapping.
• Artifactory repositories and permissions required by the package command you plan to run, including deploy and publish-build-info.
• One build name and number for collect, upload, and publish. The action can set these values for you.

Before You Begin

Use a repository whose package type matches the jf command. For the integration layers and identity rules, see . For definitions of terms such as OIDC and access token, see the .

Quick Start

To set up JFrog CLI in a GitHub Actions workflow:

Create .github/workflows/jfrog.yml:

name: JFrog build

on:
  push:

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up JFrog CLI
        uses: jfrog/setup-jfrog-cli@v4
        env:
          JF_URL: ${{ vars.JF_URL }}
          JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}

      - name: Verify the connection
        run: jf rt ping

Commit and push the workflow. A successful verification step prints:

OK

The action also sets JFROG_CLI_BUILD_NAME and JFROG_CLI_BUILD_NUMBER from the workflow name and run number. JFrog CLI package operations can therefore contribute to one build without repeating these values on every command.

What You Should See Next

To confirm that the action is working:

1. Open the GitHub workflow run and confirm that Verify the connection succeeded.
2. After you add build commands, review the JFrog Job Summary in the workflow run.
3. In the JFrog Platform UI, open Builds and select the workflow build name and run number.

The action automatically publishes collected build-info at the end of a successful workflow unless you manually publish it or set disable-auto-build-publish: true.

Use OIDC Instead of a Stored Token

OIDC requires a matching integration and identity mapping in JFrog. The workflow must be allowed to request a GitHub ID token.

To authenticate with OIDC:

permissions:
  id-token: write
  contents: read

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: jfrog/setup-jfrog-cli@v4
        env:
          JF_URL: ${{ vars.JF_URL }}
        with:
          oidc-provider-name: setup-jfrog-cli
      - run: jf rt ping

oidc-provider-name must exactly match the Provider Name in the JFrog OIDC integration. oidc-audience is optional. The action exposes oidc-token and oidc-user outputs when OIDC succeeds. Treat the token as sensitive.

Publish Package Build Information

To publish build information:

Run a package command through JFrog CLI. For example, after configuring Maven repositories:

- name: Build with Maven
  run: jf mvn clean deploy

The action's post step publishes pending build-info automatically.

To control publication yourself:

- uses: jfrog/setup-jfrog-cli@v4
  with:
    disable-auto-build-publish: true
  env:
    JF_URL: ${{ vars.JF_URL }}
    JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}

- run: |
    jf rt bce
    jf rt bag
    jf rt bp

bce collects environment data, bag adds Git metadata, and bp publishes the build. Keep the default secret-exclusion patterns. For more information about the record these commands publish, see .

Configuration Reference

The action accepts the following inputs.

The action runs on Node 24.

Package Aliases

Package aliases let later steps use native commands such as mvn, npm, and go while routing them through JFrog CLI:

- uses: jfrog/setup-jfrog-cli@v4
  with:
    version: latest
    enable-package-alias: true
    package-alias-tools: npm,mvn,go
  env:
    JF_URL: ${{ vars.JF_URL }}
    JF_ACCESS_TOKEN: ${{ secrets.JF_ACCESS_TOKEN }}

This feature requires JFrog CLI 2.93.0 or later. If alias installation fails, the action warns but does not fail the job. Subsequent native commands then run without the alias.

CI Notes

• Store JF_URL as a GitHub variable so Job Summary links are not masked.
• Store tokens and passwords as secrets.
• Pin the action to @v4, and optionally pin the CLI version.
• If a build tool is installed after this action, ensure the package-alias directory remains first in PATH.
• For an isolated network, set download-repository to an Artifactory remote repository that proxies JFrog CLI releases.

Troubleshooting

The following table lists common problems and their resolutions.

Examples

• Access-token example
• OIDC example

Related Topics