GitLab Templates for JFrog

GitLab Templates for JFrog provide ready-to-copy jobs for connecting GitLab CI to the JFrog Platform. Use them when you want a package-specific starting point for builds or audits. The templates install and configure JFrog CLI, then run standard jf commands in your job.

Prerequisites

• A GitLab project with CI/CD enabled.
• A JFrog Platform URL and credentials.
• Artifactory repository keys for the package manager used by your job.
• curl on Linux and macOS runners.
• Network access to releases.jfrog.io, or a generic remote repository that proxies https://releases.jfrog.io/artifactory/.

Store credentials as masked and protected GitLab CI/CD variables. Use one of these combinations:

• JF_URL for anonymous access.
• JF_URL, JF_USER, and JF_PASSWORD for basic authentication.
• JF_URL and JF_ACCESS_TOKEN for access-token authentication. Docker login also requires JF_USER.
• Deploy and publish-build-info permission, and the same build name and number on package and jf rt build-publish steps.

Before You Begin

Match repository keys to the package type in the template. For more information, see How Build Integration Works and Choose Plugin, CLI, or CI Wrapper.

Build and Deploy a Maven Project

This example builds and deploys a Maven project and publishes its build-info.

To build and deploy a Maven project with a GitLab template:

1. Configure these GitLab CI/CD variables with your Artifactory repository keys:
   • ARTIFACTORY_VIRTUAL_RELEASE_REPO
   • ARTIFACTORY_VIRTUAL_SNAPSHOT_REPO
   • ARTIFACTORY_LOCAL_RELEASE_REPO
   • ARTIFACTORY_LOCAL_SNAPSHOT_REPO
2. Add this job to .gitlab-ci.yml:

default:
  image: maven:3.8.6-openjdk-11-slim

include:
  - remote: "https://releases.jfrog.io/artifactory/jfrog-cli/gitlab/v2/.setup-jfrog-unix.yml"

jfrog-maven-build:
  script:
    - !reference [.setup_jfrog, script]
    - jf mvn-config --repo-resolve-releases "$ARTIFACTORY_VIRTUAL_RELEASE_REPO" --repo-resolve-snapshots "$ARTIFACTORY_VIRTUAL_SNAPSHOT_REPO" --repo-deploy-releases "$ARTIFACTORY_LOCAL_RELEASE_REPO" --repo-deploy-snapshots "$ARTIFACTORY_LOCAL_SNAPSHOT_REPO"
    - jf mvn package deploy
    - jf rt build-publish
  after_script:
    - !reference [.cleanup_jfrog, script]

The setup script exports the build name as $CI_PROJECT_PATH_SLUG-$CI_COMMIT_REF_NAME and the build number as $CI_PIPELINE_ID. A successful job uploads the Maven artifacts and publishes that build run to Artifactory.

Verify the Published Build

Open Builds in Artifactory and find the build name derived from the GitLab project and branch. The build run should use the GitLab pipeline ID as its number.

You can also verify the connection in a job with:

jf rt ping

Use the Shared Setup Script

Every package template includes a hidden .setup_jfrog job and a .cleanup_jfrog job. Reference setup before your jf commands and cleanup in after_script.

For Windows runners, include:

include:
  - remote: "https://releases.jfrog.io/artifactory/jfrog-cli/gitlab/v2/.setup-jfrog-windows.yml"

You can also vendor the script and include it with local, or keep it in another GitLab project and include it with project and file.

Set Up an Air-Gapped Download Path

Set up this path to avoid direct runner access to releases.jfrog.io.

To set up an air-gapped download path:

1. Copy the setup script into a repository available to GitLab.
2. Create a generic remote repository in Artifactory that points to https://releases.jfrog.io/artifactory/.
3. Set JF_RELEASES_REPO to that repository key.

The setup script then downloads JFrog CLI through your JFrog Platform.

Available Templates

JFrog provides build and audit templates for:

• .NET
• Go
• Gradle
• Maven
• npm
• NuGet
• pip
• Pipenv
• Yarn Berry

Build templates configure repositories and run the package command. Audit templates prepare the dependency graph needed by that package manager and run jf audit.

Configuration Reference

The templates and the setup script use the following variables.

Pipeline Considerations

• Keep setup and cleanup in the same job.
• Build-info collected in separate jobs on ephemeral runners isn't automatically combined.
• Pin the container images used by your jobs according to your organization's supply-chain policy.
• The templates run ordinary JFrog CLI commands. You can add supported CLI flags after validating them with the installed CLI version.

Troubleshooting

The following table lists common symptoms and how to resolve them.

Related Topics

• About Build Info
• Inspect Builds
• Manage Builds
• Build Integration glossary
• Build Integration FAQ