Skip to content

[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles #826

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: dev
Choose a base branch
from
Draft

[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles #826

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ebed4ca
wip
juliannguyen4 Aug 15, 2025
b3cf0ed
Merge remote-tracking branch 'origin/dev' into CLIENT-3467-cicd-use-j…
juliannguyen4 Aug 29, 2025
da9f480
get jfrog project name dynamically from env var
juliannguyen4 Aug 29, 2025
ff0960e
example was wrong?
juliannguyen4 Aug 29, 2025
cab272e
do basic plumbing
juliannguyen4 Aug 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
55 changes: 47 additions & 8 deletions .github/workflows/dev-workflow-p2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,18 +26,57 @@
sha-to-build-and-test: ${{ needs.bump-dev-number.outputs.bump_sha }}
secrets: inherit

upload-to-jfrog:
name: Upload artifacts to JFrog
get-jfrog-project-to-store-artifacts:
needs: rebuild-artifacts-with-new-dev-num
name: Get Jfrog project to store artifacts
runs-on: ubuntu-24.04
outputs:
jfrog-project: ${{ steps.get-env-vars.outputs.jfrog_project }}
jfrog-build-name: ${{ steps.get-env-vars.outputs.jfrog_build_name }}

steps:
- name: Get outputs
id: get-env-vars
run: |
echo jfrog_project=${{ env.JFROG_PYTHON_CLIENT_PROJECT }} >> $GITHUB_OUTPUT
echo jfrog_build_name=${{ env.JFROG_BUILD_NAME }} >> $GITHUB_OUTPUT
upload-github-artifacts-to-jfrog:
needs: [
bump-dev-number,
rebuild-artifacts-with-new-dev-num
get-jfrog-project-to-store-artifacts
]
uses: ./.github/workflows/upload-to-jfrog.yml
uses: aerospike/shared-workflows/.github/workflows/reusable_upload-artifacts.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1
with:
project: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-project }}
build-name: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-build-name }}
version: ${{ needs.bump-dev-number.outputs.new_version }}
secrets: inherit

create-jfrog-release-bundle:
needs: [
bump-dev-number,
get-jfrog-project-to-store-artifacts,
upload-github-artifacts-to-jfrog
]
uses: aerospike/shared-workflows/.github/workflows/reusable_create-release-bundle.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1
with:
project: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-project }}
build-names: "${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-build-name }}:${{ needs.bump-dev-number.outputs.new_version }}"
bundle-name: asdf
version: ${{ needs.bump-dev-number.outputs.new_version }}

# upload-to-jfrog:
# name: Upload artifacts to JFrog
# needs: [
# bump-dev-number,
# rebuild-artifacts-with-new-dev-num
# ]
# uses: ./.github/workflows/upload-to-jfrog.yml
# with:
# version: ${{ needs.bump-dev-number.outputs.new_version }}
# secrets: inherit

# We don't want the artifacts in JFrog to also exist in Github
delete-artifacts:
needs: upload-to-jfrog
uses: ./.github/workflows/delete-artifacts.yml
# delete-artifacts:
# needs: upload-to-jfrog
# uses: ./.github/workflows/delete-artifacts.yml
Comment on lines +56 to +82

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

The best fix is to add an explicit permissions block as early as possible in the workflow YAML file, typically just below the name: and before the on: key (which will apply to all jobs that do not specify their own permissions block). The permissions block should specify only those privileges required by the workflow (preferably contents: read unless the jobs require additional write privileges, such as contents: write or issues: write). Since the workflow is handling artifact uploads, version bumps, and possibly PR-related changes, it's safe to start with contents: read and grant more if needed after a functional test. As required and as a minimal baseline, the recommended block is:

permissions:
  contents: read

You can later strengthen or refine this if the workflow needs more (such as pull-requests: write).

What to do:

  • In .github/workflows/dev-workflow-p2.yml, insert a permissions: block after the name: field, before the on: block (after line 1).
  • Use the recommended minimal setting: contents: read.

No imports or new methods are required for this change, as it is a configuration edit.

Suggested changeset 1
.github/workflows/dev-workflow-p2.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/dev-workflow-p2.yml b/.github/workflows/dev-workflow-p2.yml
--- a/.github/workflows/dev-workflow-p2.yml
+++ b/.github/workflows/dev-workflow-p2.yml
@@ -1,4 +1,6 @@
 name: Dev workflow (part 2)
+permissions:
+  contents: read
 
 on:
   pull_request_target:
EOF
@@ -1,4 +1,6 @@
name: Dev workflow (part 2)
permissions:
contents: read

on:
pull_request_target:
Copilot is powered by AI and may make mistakes. Always verify output.
Loading