Switch CI to hardened runners with JFrog OIDC authentication#753
Open
mihaimitrea-db wants to merge 10 commits intomainfrom
Open
Switch CI to hardened runners with JFrog OIDC authentication#753mihaimitrea-db wants to merge 10 commits intomainfrom
mihaimitrea-db wants to merge 10 commits intomainfrom
Conversation
Route Maven dependency resolution through JFrog Artifactory on hardened runners that block direct access to Maven Central. Authenticate via GitHub Actions OIDC (zero stored secrets). - Add composite action for JFrog OIDC + Java setup - Switch fmt, unit-tests (Linux), and check-lock to databricks-protected-runner-group - Add workflow-level id-token: write permission for OIDC - Keep macOS unit-tests on public runners (not hardened) NO_CHANGELOG=true
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
Hardened runners terminate SSL handshakes to repo.maven.apache.org, so Maven needs an explicit mirror pointing to JFrog Artifactory. Generate ~/.m2/settings.xml with OIDC credentials from the JFrog setup step.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
When lockfiles are regenerated while Maven resolves through JFrog (CI or VPN), the resolved URLs point to databricks.jfrog.io instead of repo.maven.apache.org. This target rewrites them back to public Maven Central URLs before committing.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
Run make fix-lockfile in the fmt job and fail on git diff, catching any accidentally committed JFrog proxy URLs in lockfile.json. Same CI enforcement pattern as the Python SDK.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
hectorcast-db
approved these changes
Apr 7, 2026
The lockfile is out of date on main (commons-configuration2 2.11.0 vs 2.13.0 in POM). This temporary job regenerates it through JFrog and normalizes URLs back to Maven Central. The check-lock job now depends on it so it validates the freshly generated lockfile. Remove this job once the lockfile is up to date.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
The actions/cache step was restoring ~/.m2 (including settings.xml from a previous run with an expired OIDC token) after the composite action generated a fresh settings.xml. This caused 401 errors on subsequent runs. Fix by: 1. Caching only ~/.m2/repository (artifacts only, not settings.xml) 2. Moving cache restore before the build environment setup
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
The lockfile has been regenerated and committed. Remove the temporary job and restore check-lock to run independently with the same cache and build environment setup as other jobs.
mihaimitrea-db
temporarily deployed
to
test-trigger-is
GitHub Actions
Inactive
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
Use matrix include to map os strings to runner configs instead of restructuring the matrix with object values. This keeps the auto- generated check names (e.g. unit-tests (ubuntu-latest, 8)) matching what branch protection rules expect.
|
If integration tests don't run automatically, an authorized user can run them manually by following the instructions below: Trigger: Inputs:
Checks will be approved automatically on success. |
mihaimitrea-db
had a problem deploying
to
test-trigger-is
GitHub Actions
Failure
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Route Maven dependency resolution through JFrog Artifactory on hardened runners that block direct access to Maven Central. Authenticate via GitHub Actions OIDC (zero stored secrets).
Modeled after the CLI (#4875), Go SDK (#1609), and Python SDK (#1379).
What changed
.github/actions/setup-build-environment/action.yml): Sets up JFrog CLI via OIDC, installs the JDK, and generates a~/.m2/settings.xmlthat mirrors all Maven repositories through JFrog (db-maven). Skipped on macOS (not hardened).push.yml: Added workflow-levelid-token: writepermission for OIDC. Switchedfmt,unit-tests(Linux), andcheck-lockjobs todatabricks-protected-runner-group. macOS tests remain on public runners. Used matrixincludeto map OS strings to runner configs, preserving the original check names for branch protection compatibility.Makefile: Addedfix-lockfiletarget.lockfile.json: Regenerated to pick upcommons-configuration22.13.0 (was out of date since PR Bump commons-configuration2 from 2.11.0 to 2.13.0 #743 bumped the POM without regenerating the lockfile).Why settings.xml is needed
Hardened runners terminate SSL handshakes to
repo.maven.apache.org. Unlike Go (GOPROXYenv var) or Python (UV_INDEX_URL), Maven has no environment variable to redirect repository access. The standard mechanism is a~/.m2/settings.xmlwith a<mirror>entry that routes all repository requests through JFrog.The lockfile problem
Maven's
lockfile.jsonstores the full download URL in each dependency'sresolvedfield. When Maven resolves through JFrog, these becomehttps://databricks.jfrog.io/artifactory/db-maven/...instead ofhttps://repo.maven.apache.org/maven2/.... If someone runsmake lockwhile Maven is routed through JFrog (CI, VPN), the lockfile would contain proxy URLs that shouldn't be committed.make fix-lockfile
Replaces JFrog proxy URLs with their public Maven Central equivalents in all
lockfile.jsonfiles. Prevents proxy URLs from being accidentally committed.When to use it: Run
make fix-lockfilebefore committing if you regenerated the lockfile while Maven was routing through JFrog.CI enforcement: The
fmtjob runsmake fix-lockfilefollowed bygit diff --exit-code, so any committed proxy URLs will fail CI.Cache ordering
The Maven cache (
~/.m2/repository) must be restored before the composite action runs. The composite action generates~/.m2/settings.xmlwith a fresh OIDC token. If the cache step runs after and restores~/.m2(including a stalesettings.xmlfrom a previous run), the expired token causes 401 errors. Caching only~/.m2/repository(not all of~/.m2) prevents this.Out of scope
Test plan
NO_CHANGELOG=true