Switch CI to hardened runners with JFrog OIDC authentication#753
Open
mihaimitrea-db wants to merge 4 commits intomainfrom
Open
Switch CI to hardened runners with JFrog OIDC authentication#753mihaimitrea-db wants to merge 4 commits intomainfrom
mihaimitrea-db wants to merge 4 commits intomainfrom
Conversation
Route Maven dependency resolution through JFrog Artifactory on hardened runners that block direct access to Maven Central. Authenticate via GitHub Actions OIDC (zero stored secrets). - Add composite action for JFrog OIDC + Java setup - Switch fmt, unit-tests (Linux), and check-lock to databricks-protected-runner-group - Add workflow-level id-token: write permission for OIDC - Keep macOS unit-tests on public runners (not hardened) NO_CHANGELOG=true
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
Hardened runners terminate SSL handshakes to repo.maven.apache.org, so Maven needs an explicit mirror pointing to JFrog Artifactory. Generate ~/.m2/settings.xml with OIDC credentials from the JFrog setup step.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
When lockfiles are regenerated while Maven resolves through JFrog (CI or VPN), the resolved URLs point to databricks.jfrog.io instead of repo.maven.apache.org. This target rewrites them back to public Maven Central URLs before committing.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Run make fix-lockfile in the fmt job and fail on git diff, catching any accidentally committed JFrog proxy URLs in lockfile.json. Same CI enforcement pattern as the Python SDK.
|
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Route Maven dependency resolution through JFrog Artifactory on hardened runners that block direct access to Maven Central. Authenticate via GitHub Actions OIDC (zero stored secrets).
databricks-protected-runner-groupid-token: writepermission for OIDCModeled after the CLI (#4875), Go SDK (#1609), and Python SDK (#1379).
Out of scope
ubuntu-latestTest plan
mvn --errors spotless:checkpasses (fmt job)mvn --errors testpasses on Linux (Java 8, 11, 17, 20)mvn --errors testpasses on macOS (Java 8, 11, 17, 20)make check-lockpasses (lockfile validation)NO_CHANGELOG=true