Task leaks credentials to other jobs about setup-jfrog-cli HOT 5 CLOSED

@wichert,
Thanks for reporting this issue.
The Setup JFrog CLI GitHub Action downloads the JFrog CLI and configures the JFrog connection details under $USER_HOME/.jfrog/. The credentials will be available to all next JFrog CLI commands.
The Action can't have a post script, since the JFrog CLI commands run after this Action.
Therefore, for self-hosted agents, we'd recommend to configure a cleanup step:

# Run the action
- jfrog/setup-jfrog-cli@v1
  env:
  JF_ARTIFACTORY_1: ${{ secrets.JF_ARTIFACTORY_SECRET_1 }}
# Run CLI commands 
- run: |
   jfrog rt ...

...

# Clean up at the end of the workflow
- name: Clean Up
   if: always()
   run: jfrog c rm --quiet

Please let us know if that helped.

from setup-jfrog-cli.

@yahavi You should use the post action to clear credentials. See for example how the docker/login-action does this: https://github.com/docker/login-action/blob/master/action.yml#L27

from setup-jfrog-cli.

@yahavi To be clear: the post run step executes at the end of the workflow, not at the end of the step. This is not documented correctly in the GitHub Action documentation.

from setup-jfrog-cli.

@wichert,
I didn't know this. Thanks for this information!
I created #35 to resolve this issue.

from setup-jfrog-cli.

@wichert,
Setup JFrog CLI 1.1.4 is released and synchronized in the v1 tag as well.
This version contains #35.
We'd appreciate your feedback on that.

from setup-jfrog-cli.