Skip to content

Move CI to Databricks protected runners with JFrog OIDC#348

Merged
vikrantpuppala merged 1 commit intomainfrom
move-ci-to-protected-runners-jfrog
Apr 13, 2026
Merged

Move CI to Databricks protected runners with JFrog OIDC#348
vikrantpuppala merged 1 commit intomainfrom
move-ci-to-protected-runners-jfrog

Conversation

@vikrantpuppala
Copy link
Copy Markdown
Collaborator

Summary

  • Add .github/actions/setup-jfrog composite action for OIDC-based JFrog authentication (configures GOPROXY and .netrc for Go module proxy)
  • Switch all workflow jobs (lint, build-and-test, dco-check) from ubuntu-latest to databricks-protected-runner-group
  • Add id-token: write permission for JFrog OIDC token exchange

Test plan

  • DCO check workflow passes on this PR
  • Lint job passes with Go modules resolved through JFrog proxy
  • Build and test job passes with Go modules resolved through JFrog proxy
  • Verify JFrog OIDC token exchange works on protected runners

This pull request was AI-assisted by Isaac.

Switch all workflow jobs from ubuntu-latest to databricks-protected-runner-group
per go/hardened-gha guidance. Add JFrog OIDC authentication via a reusable
composite action that configures GOPROXY to route Go module downloads through
JFrog Artifactory.

Co-authored-by: Isaac
Signed-off-by: Vikrant Puppala <vikrant.puppala@databricks.com>
@vikrantpuppala vikrantpuppala force-pushed the move-ci-to-protected-runners-jfrog branch from 5b1ce8d to 84f18f6 Compare April 13, 2026 10:56
@@ -33,13 +39,17 @@ jobs:
strategy:
matrix:
go-version: [1.20.x]
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

llm comment on EOL version 1.20.x.
switch to 1.21 or 1.22 + later versions

Copy link
Copy Markdown
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cannot update go version, certain customer apps require 1.20.x compatibility

@vikrantpuppala vikrantpuppala merged commit dbce21a into main Apr 13, 2026
3 checks passed
@vikrantpuppala vikrantpuppala deleted the move-ci-to-protected-runners-jfrog branch April 13, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants