Skip to content

[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles #826

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
wants to merge 5 commits into
base: dev
Choose a base branch
from
Draft

[CLIENT-3467] CI/CD: Publish artifacts to JFrog using release bundles #826

Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
ebed4ca
wip
juliannguyen4 Aug 15, 2025
b3cf0ed
Merge remote-tracking branch 'origin/dev' into CLIENT-3467-cicd-use-j…
juliannguyen4 Aug 29, 2025
da9f480
get jfrog project name dynamically from env var
juliannguyen4 Aug 29, 2025
ff0960e
example was wrong?
juliannguyen4 Aug 29, 2025
cab272e
do basic plumbing
juliannguyen4 Aug 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 46 additions & 12 deletions .github/workflows/dev-workflow-p2.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,18 +26,52 @@
sha-to-build-and-test: ${{ needs.bump-dev-number.outputs.bump_sha }}
secrets: inherit

upload-to-jfrog:
name: Upload artifacts to JFrog
needs: [
bump-dev-number,
rebuild-artifacts-with-new-dev-num
]
uses: ./.github/workflows/upload-to-jfrog.yml
get-jfrog-project-to-store-artifacts:
needs: rebuild-artifacts-with-new-dev-num
name: Get Jfrog project to store artifacts
runs-on: ubuntu-24.04
outputs:
jfrog-project: ${{ steps.get-jfrog-project.outputs.jfrog_project }}

steps:
- id: get-jfrog-project
run: echo jfrog_project=${{ env.JFROG_PYTHON_CLIENT_PROJECT }} >> $GITHUB_OUTPUT

upload-github-artifacts-to-jfrog:

Check warning

Code scanning / CodeQL

Workflow does not contain permissions Medium

Actions job or workflow does not limit the permissions of the GITHUB_TOKEN. Consider setting an explicit permissions block, using the following as a minimal starting point: {}

Copilot Autofix

AI 3 months ago

To fix the problem, add a permissions key to the root level of the workflow file (.github/workflows/dev-workflow-p2.yml). This key should set the least necessary privileges required for the workflow to function. At a minimum, set contents: read, and add more granular permissions only if a job requires them (such as pull-requests: write if you manage PRs, or issues: write if you open/modify issues). Since most jobs reuse other workflows and interact mostly with artifacts, no write permissions are obviously required for contents, so start with just contents: read. If upon workflow usage additional permissions errors arise, add the minimum necessary permissions for each required type.

Edit .github/workflows/dev-workflow-p2.yml and insert a permissions block at the top level, directly after the name: field and before on:. For now, only set contents: read.

Suggested changeset 1
.github/workflows/dev-workflow-p2.yml

Autofix patch

Autofix patch
Run the following command in your local git repository to apply this patch
cat << 'EOF' | git apply
diff --git a/.github/workflows/dev-workflow-p2.yml b/.github/workflows/dev-workflow-p2.yml
--- a/.github/workflows/dev-workflow-p2.yml
+++ b/.github/workflows/dev-workflow-p2.yml
@@ -1,4 +1,6 @@
 name: Dev workflow (part 2)
+permissions:
+  contents: read
 
 on:
   pull_request_target:
EOF
@@ -1,4 +1,6 @@
name: Dev workflow (part 2)
permissions:
contents: read

on:
pull_request_target:
Copilot is powered by AI and may make mistakes. Always verify output.
needs: get-jfrog-project-to-store-artifacts
uses: aerospike/shared-workflows/workflows/reusable_upload-artifacts.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1
with:
version: ${{ needs.bump-dev-number.outputs.new_version }}
secrets: inherit
project: ${{ needs.get-jfrog-project-to-store-artifacts.outputs.jfrog-project }}
# build-name:
# description: JFrog build name
# required: true
# type: string
# version:
# description: Version of the artifact to upload
# required: true
# type: string

create-jfrog-release-bundle:
needs: upload-github-artifacts-to-jfrog
uses: aerospike/shared-workflows/workflows/reusable_create-release-bundle.yaml@34ffd4613504a792f3cd5530c69fb9a3115ad9c1
with:
project: clients
# build-names:
# bundle-name:
# version:

# upload-to-jfrog:
# name: Upload artifacts to JFrog
# needs: [
# bump-dev-number,
# rebuild-artifacts-with-new-dev-num
# ]
# uses: ./.github/workflows/upload-to-jfrog.yml
# with:
# version: ${{ needs.bump-dev-number.outputs.new_version }}
# secrets: inherit

# We don't want the artifacts in JFrog to also exist in Github
delete-artifacts:
needs: upload-to-jfrog
uses: ./.github/workflows/delete-artifacts.yml
# delete-artifacts:
# needs: upload-to-jfrog
# uses: ./.github/workflows/delete-artifacts.yml
Loading