action.yml

name: Setup JFrog OIDC
description: Obtain a JFrog access token via GitHub OIDC and configure pip to use JFrog PyPI proxy

runs:
  using: composite
  steps:
    - name: Get JFrog OIDC token
      shell: bash
      run: |
        set -euo pipefail
        ID_TOKEN=$(curl -sLS \
          -H "User-Agent: actions/oidc-client" \
          -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
          "${ACTIONS_ID_TOKEN_REQUEST_URL}&audience=jfrog-github" | jq .value | tr -d '"')
        echo "::add-mask::${ID_TOKEN}"
        ACCESS_TOKEN=$(curl -sLS -XPOST -H "Content-Type: application/json" \
          "https://databricks.jfrog.io/access/api/v1/oidc/token" \
          -d "{\"grant_type\": \"urn:ietf:params:oauth:grant-type:token-exchange\", \"subject_token_type\":\"urn:ietf:params:oauth:token-type:id_token\", \"subject_token\": \"${ID_TOKEN}\", \"provider_name\": \"github-actions\"}" | jq .access_token | tr -d '"')
        echo "::add-mask::${ACCESS_TOKEN}"
        if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
          echo "FAIL: Could not extract JFrog access token"
          exit 1
        fi
        echo "JFROG_ACCESS_TOKEN=${ACCESS_TOKEN}" >> "$GITHUB_ENV"
        echo "JFrog OIDC token obtained successfully"

    - name: Configure pip
      shell: bash
      run: |
        set -euo pipefail
        echo "PIP_INDEX_URL=https://gha-service-account:${JFROG_ACCESS_TOKEN}@databricks.jfrog.io/artifactory/api/pypi/db-pypi/simple" >> "$GITHUB_ENV"
        echo "pip configured to use JFrog registry"