{"id":31769969,"url":"https://github.com/jfrog/jfrog-azure-devops-extension","last_synced_at":"2026-01-16T11:00:00.350Z","repository":{"id":37669446,"uuid":"142118457","full_name":"jfrog/jfrog-azure-devops-extension","owner":"jfrog","description":null,"archived":false,"fork":false,"pushed_at":"2026-01-12T12:18:58.000Z","size":8174,"stargazers_count":52,"open_issues_count":79,"forks_count":74,"subscribers_count":14,"default_branch":"v2","last_synced_at":"2026-01-12T19:38:58.860Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"JavaScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/jfrog.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2018-07-24T07:03:34.000Z","updated_at":"2026-01-09T09:27:09.000Z","dependencies_parsed_at":"2024-06-18T17:22:53.125Z","dependency_job_id":"3125c85b-c233-4c30-990b-24d3debf8d53","html_url":"https://github.com/jfrog/jfrog-azure-devops-extension","commit_stats":null,"previous_names":[],"tags_count":95,"template":false,"template_full_name":null,"purl":"pkg:github/jfrog/jfrog-azure-devops-extension","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jfrog%2Fjfrog-azure-devops-extension","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jfrog%2Fjfrog-azure-devops-extension/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jfrog%2Fjfrog-azure-devops-extension/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jfrog%2Fjfrog-azure-devops-extension/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/jfrog","download_url":"https://codeload.github.com/jfrog/jfrog-azure-devops-extension/tar.gz/refs/heads/v2","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/jfrog%2Fjfrog-azure-devops-extension/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":28478106,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-01-16T06:30:42.265Z","status":"ssl_error","status_checked_at":"2026-01-16T06:30:16.248Z","response_time":107,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-10-10T02:55:58.879Z","updated_at":"2026-01-16T11:00:00.343Z","avatar_url":"https://github.com/jfrog.png","language":"JavaScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\n[![](images/introduction.png)](https://github.com/jfrog/jfrog-azure-devops-extension)\n\n# JFrog Azure DevOps Extension\n\n|                                                                                                           Azure DevOps Extension                                                                                                           | Installs                                                                                                                                                                                                                                                                                                    |                                                                                                                                   Tests (Master)                                                                                                                                    |                                                                                                                                           Tests (Dev)                                                                                                                                           |\n|:------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|:-----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------:|\n| [![JFrog Extension Marketplace](https://img.shields.io/static/v1?label=%20\u0026color=blue\u0026style=for-the-badge\u0026logo=azuredevops\u0026message=JFrog%20(New))](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension) | [![JFrog Extension Marketplace Installs](https://img.shields.io/visual-studio-marketplace/azure-devops/installs/total/JFrog.jfrog-azure-devops-extension?label=Total\u0026color=blue\u0026style=for-the-badge)](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)               | [![Tests](https://github.com/jfrog/jfrog-azure-devops-extension/actions/workflows/tests.yml/badge.svg)](https://github.com/jfrog/jfrog-azure-devops-extension/actions/workflows/tests.yml)  |     [![Tests](https://github.com/jfrog/jfrog-azure-devops-extension/actions/workflows/tests.yml/badge.svg?branch=dev)](https://github.com/jfrog/jfrog-azure-devops-extension/actions/workflows/tests.yml)      |\n|  [![JFrog Extension Marketplace](https://img.shields.io/static/v1?label=%20\u0026color=blue\u0026style=for-the-badge\u0026logo=azuredevops\u0026message=Artifactory)](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)  | [![Artifactory Extension Marketplace Installs](https://img.shields.io/visual-studio-marketplace/azure-devops/installs/total/JFrog.jfrog-artifactory-vsts-extension?label=Total\u0026color=blue\u0026style=for-the-badge)](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-artifactory-vsts-extension) | [![Build status](https://ci.appveyor.com/api/projects/status/ki6edykufqy9h5bl/branch/v1?svg=true\u0026passingText=v1%20-%20passing\u0026failingText=dev%20-%20failing\u0026pendingText=dev%20-%20pending)](https://ci.appveyor.com/project/jfrog-ecosystem/jfrog-azure-devops-extension/branch/v1) | [![Build status](https://ci.appveyor.com/api/projects/status/ki6edykufqy9h5bl/branch/dev-v1?svg=true\u0026passingText=dev-v1%20-%20passing\u0026failingText=dev%20-%20failing\u0026pendingText=dev%20-%20pending)](https://ci.appveyor.com/project/jfrog-ecosystem/jfrog-azure-devops-extension/branch/dev-v1) |\n\n\u003c/div\u003e\n\n# Overview\n\n[JFrog](https://jfrog.com/) provides tight integration with [Azure DevOps](https://azure.microsoft.com/en-us/services/devops/) through the *[JFrog Extension](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)*\nBeyond managing efficient deployment of your artifacts to [JFrog Artifactory](https://jfrog.com/artifactory), the extension lets you capture information about\nartifacts deployed, dependencies resolved, environment data associated with the build runs and more,\nthat effectively facilitates fully traceable builds.\nJFrog brings continuous integration to [Azure DevOps](https://azure.microsoft.com/en-us/services/devops/) through the *JFrog* extension.\n\nThe *[JFrog Extension](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)* for Azure DevOps supports:\n\n* Running your builds while using [JFrog Artifactory](https://jfrog.com/artifactory) as the binary repository manager.\n* Gaining full traceability of your builds by capturing your build-info from your builds and publishing it to [JFrog Artifactory](https://jfrog.com/artifactory).\n* Managing your binaries lifecycle with [JFrog Artifactory](https://jfrog.com/artifactory).\n* Auditing your projects and scanning your builds with [JFrog Xray](https://jfrog.com/xray).\n* Distributing your artifacts with [JFrog Distribution](https://jfrog.com/distribution/).\n\n\n## Table of contents\n\n- [Table of contents](#Table-of-contents)\n    - [Overview](#Overview)\n    - [Download and Installation](#Download-and-Installation)\n        - [Installing the Extension](#Installing-the-Extension)\n        - [Installing the Build Agent](#Installing-the-Build-Agent)\n        - [Configuring the Service Connections](#Configuring-the-Service-Connections)\n        - [Using OpenID Connect (OIDC) Authentication](#using-openid-connect-oidc-authentication)\n    - [Executing JFrog CLI Commands](#Executing-JFrog-CLI-Commands)\n    - [Build tools Tasks](#build-tools-tasks)\n        - [JFrog Maven](#JFrog-Maven-Task)\n        - [JFrog Gradle](#JFrog-Gradle-Task)\n        - [JFrog Npm](#JFrog-Npm-Task)\n        - [JFrog Nuget](#JFrog-Nuget-and-NET-Core-Task)\n        - [JFrog .NET Core](#JFrog-Nuget-and-NET-Core-Task)\n        - [JFrog Pip](#JFrog-Pip-Task)\n        - [JFrog Conan](#JFrog-Conan-Task)\n        - [JFrog Go](#JFrog-Go-Task)\n    - [Build Tasks](#Build-tasks)\n        - [JFrog Collect Build Issues](#JFrog-Collect-Build-Issues)\n        - [JFrog Publish Build Info](#JFrog-Publish-Build-Info)\n        - [JFrog Build Promotion](#JFrog-Build-Promotion)\n        - [Discarding Published Builds](#Discarding-Published-Builds-from-Artifactory)\n    - [Managing Generic Artifacts](#Managing-Generic-Artifacts)\n    - [JFrog Xray](#JFrog-Xray-tasks)\n        - [Audit project's dependencies for Security Vulnerabilities](#Audit-projects-dependencies-for-Security-Vulnerabilities)\n        - [Scanning Published Builds for Security Vulnerabilities with JFrog Xray](#Scanning-Published-Builds-for-Security-Vulnerabilities)\n    - [JFrog Docker Tasks](#JFrog-Docker-tasks)\n        - [Pushing and Pulling Docker Images to and from Artifactory](#Pushing-and-Pulling-Docker-Images-to-and-from-Artifactory)\n        - [Scanning Local Docker Images with JFrog Xray](#Scanning-Local-Docker-Images-with-JFrog-Xray)\n    - [JFrog Distribution](#Managing-and-Distributing-Release-Bundles)\n        - [JFrog Distribution Task](#JFrog-Distribution-V2-Task)\n    - [Contributions](#Contribution)\n\n## Download and Installation\n\n### Installing the Extension\n\nTo install the *[JFrog Extension](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)*, execute the following steps:\n\n* Go to\n  the [Visual Studio Marketplace Jfrog Extension Page](https://marketplace.visualstudio.com/items?itemName=JFrog.jfrog-azure-devops-extension)\n  and sign in to your account.\n\n  \u003cimg src=\"./images/extension-install.png\" alt=\"\"/\u003e\n  \n* Click on *Get It Free*\n\n  \u003cimg width=\"400px\" src=\"./images/get-it-free.png\" alt=\"\"\u003e\n  \n* Select the account to which you want to apply the extension and confirm installation.\n\n* In the JFrog Extension page, click *Install*.\n\n  \u003cimg width=\"400px\" src=\"./images/organization-install.png\" alt=\"\"\u003e\n\n\n\n### Installing the Build Agent\n\nTo run the JFrog tasks, the build agents use the following tools:\n\n* JFrog CLI: Runs all the JFrog tasks.\n* Maven Extractor (Used by the [JFrog Maven](#jfrog-maven-task) task)\n* Gradle Extractor (Used by the [JFrog Gradle](#jfrog-gradle-Task) task)\n* Conan client (Used by the [JFrog Conan](#jfrog-conan-task) task)\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Automatic Installation\n\u003c/summary\u003e\n\nIf the build agent has access to the internet, JFrog CLI along with the Maven and Gradle Extractors are downloaded and\ninstalled automatically on the agent, the first time they are required.\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Custom tools Installation\n\u003c/summary\u003e\n\nYou can configure the pipeline to download JFrog CLI and the Maven Extractor from a JFrog Artifactory instance, which is\nconfigured to proxy the download repositories.\n\n* Create two remote repositories in Artifactory:\n* Create a remote repository in Artifactory for downloading *JFrog CLI*. Name the repository *jfrog-cli-remote* and\n  set its URL\n  to [https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/](https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/)\n* Create a remote repository in Artifactory for downloading the *Maven and Gradle Extractors*. Name the URL *extractors* and set its URL\n  to: [https://releases.jfrog.io/artifactory/oss-release-local/](https://releases.jfrog.io/artifactory/oss-release-local/)\n* Make sure to configure the Artifactory server with the *jfrog-cli-remote* and *extractors* repositories in as a\n  [service connection](#Configuring-the-Service-Connections) in Azure DevOps of type *JFrog Artifactory V2*.\n* Add the *JFrog Tools Installer* task to your build or release pipeline.\n* Select the Artifactory service you configured.\n* Select *jfrog-cli-remote* as the target repository to download the JFrog CLI.\n* If your pipeline uses the [JFrog Maven](#jfrog-maven-task) or [JFrog Gradle](#jfrog-Gradle-task) tasks, select *extractors* as the repository to\n  download the Maven Extractor.\n\n![tool-installer.png](images/tool-installer.png)\n\n```YAML\n- task: JFrogToolsInstaller@1\n  inputs:\n    artifactoryConnection: 'jfrog artifactory'\n    cliInstallationRepo: 'jfrog-cli-remote'\n    installExtractors: true\n    extractorsInstallationRepo: 'extractors'\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Manual Installation\n\u003c/summary\u003e\n\n##### Installing JFrog CLI\n\nThe extension runs JFrog CLI in the background to run many of its operations.\nThe extension automatically downloads and installs the JFrog CLI on the build agent the first time it's required.\nHowever, if your build agent does not have access to the internet, the build will fail when attempting to download JFrog\nCLI, and you'll need to download and install it manually.\n\nTo install JFrog CLI on an agent with no internet access:\n\n1. Create the directory structure on your agent's `file-system: $(Agent.ToolsDirectory)/_jf/current/`\n2. Download the latest JFrog CLI version from [here](https://releases.jfrog.io/artifactory/jfrog-cli/v2-jf/).\n3. Please make sure to download the executable matching your agent's operating system. Make sure to download the *jf*\n   executable of JFrog CLI and not the legacy *jfrog* executable.\n4. Copy the downloaded *jf* executable to the *current* directory you created.\n\n##### Installing the Maven Extractor\n\nWhen triggering the [JFrog Maven](#jfrog-maven-task) task, JFrog CLI automatically downloads the Maven Extractor jar to the build agent\nthe first time it's required.\nHowever, if your build agent does not have access to the internet, the build will fail when attempting to download the\nfile.\nYou'll therefore need to download and install it manually.\n\nTo install the Maven Extractor jar on an agent with no internet access:\n\n1. Create the directory structure on your agent's\n   file-system: `~/.jfrog/dependencies/maven/2.x.x`\n2. Download\n   the latest [build-info-extractor-maven3-2.x.x-uber.jar](https://search.maven.org/artifact/org.jfrog.buildinfo/build-info-extractor)\n   and place it inside the \"maven\" directory you created.\n\n##### Installing the Gradle Extractor\n\nWhen triggering the [JFrog Gradle](#jfrog-gradle-task) task, JFrog CLI automatically downloads the Gradle Extractor jar to the build\nagent the first time it's required.\nHowever, if your build agent does not have access to the internet, the build will fail when attempting to download the\nfile. You'll therefore need to download and install it manually.\n\nTo install the Gradle Extractor jar on an agent with no internet access:\n\n1. Create the directory structure on your agent's\n   file-system: `~/.jfrog/dependencies/gradle/4.x.x`\n2. Download\n   the latest [build-info-extractor-gradle-4.x.x-uber.jar](https://plugins.gradle.org/plugin/com.jfrog.artifactory)\n   and place it inside the \"gradle\" directory you created.\n\n##### Installing Conan\n\nFor the build agent to be able to run conan builds, do the following:\n\n1. Access the agent and install conan by following [these steps](https://docs.conan.io/en/latest/installation.html).\n2. Confirm that the conan executable is available in the Path environment variable of the user which runs the build on\n   the agent.\n\n\u003e The JFrog Conan task uses the Conan client. The Conan client cannot be installed\n\u003e using the Automatic Installation or the JFrog Tools Installer but is required to be manually installed.\n\n##### Using TFS 2015\n\nNode.JS version 8 and above.\n\nThe build agent requires using Node.JS version 8 and above. To check which version of Node.JS is running on the build\nagent:\n\n1. Navigate to the `Worker\\Handlers\\Node` folder located under the Agent home.\n2. From the terminal, run *node -v*\n\nTo upgrade Node.JS on the build agent:\n\n* Replace the existing node.exe file on the agent with the node.exe file with the required version located in\n  the `Worker\\Handlers\\Node` folder under the agent home.\n\n\u003c/details\u003e\n\n## Configuring the Service Connections\n\nTo allow the JFrog tasks to work with your JFrog environment, you'll need to configure the following service connections\nin Azure DevOps.\n\n|                     Service connection                      | Used by tasks                                                                                                                                                                                                                                                                     |                \n|:-----------------------------------------------------------:|:----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n|   \u003cimg width=\"200px\" src=\"./images/service-platform.png\"\u003e   | JFrog CLI V2                                                                                                                                                                                                                                                                      | \n| \u003cimg width=\"200px\" src=\"./images/service-artifactory.png\"\u003e  | JFrog Tools Installer\u003cbr\u003eJFrog Generic Artifacts\u003cbr\u003eJFrog Nuget\u003cbr\u003eJFrog .NET Core\u003cbr\u003eJFrog npm\u003cbr\u003eJFrog Pip\u003cbr\u003eJFrog Maven\u003cbr\u003eJFrog Gradle\u003cbr\u003eJFrog Go\u003cbr\u003eJFrog Conan\u003cbr\u003eJFrog Collect Build Issues\u003cbr\u003eJFrog Discard Builds\u003cbr\u003eJFrog Build Promotion\u003cbr\u003eJFrog Publish Build Info |   \n|     \u003cimg width=\"200px\" src=\"./images/service-xray.png\"\u003e     | JFrog Audit\u003cbr\u003eJFrog Build Scan                                                                                                                                                                                                                                                   | \n| \u003cimg width=\"200px\" src=\"./images/service-distribution.png\"\u003e | JFrog Distribution                                                                                                                                                                                                                                                                | \n\n\u003cdetails\u003e\n  \u003csummary\u003eNot Using a Public CA (Certificate Authority)?\u003c/summary\u003e\n\nThis section is relevant for you, if you're not using a public CA (Certificate Authority) to issue the SSL certificate\nused to connect to your JFrog instance domain.\nYou may not be using a public CA either because you're using self-signed certificates or you're running your own PKI\nservices in-house (often by using a Microsoft CA).\nIn this case, you'll need to make those certificates available for JFrog CLI, which is used by most of JFrog tasks.\nTo make the certificates available for JFrog CLI, you'll need to place them inside the security/certs directory, which\nis under JFrog CLI's home directory.\nThe home directory default location is `$(Agent.ToolsDirectory)/_jf/`\n\nRead more about this in the [JFrog CLI](https://jfrog.com/help/r/jfrog-cli/jfrog-cli).\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003eCan't Access your JFrog instance?\u003c/summary\u003e\n\nFor security reasons, the JFrog SaaS service supports only TLS 1.2. Since not all TFS versions support TLS 1.2, you may\nneed to enable TLS 1.2 on TFS.\nTo enable TLS 1.2 on TFS:\n\n1. Create a file and name and name it: `Microsoft.PowerShell_profile.ps1`\n2. Add the following line to the file: `[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12`\n3. Place the file in the following location on the TFS machine: `C:\\Users\\\u003cusername\u003e\\Documents\\WindowsPowerShell`\n\n\u003e Note: Make sure \u003cusername\u003e matches the name of the user running TFS and the build agents.\n\n\u003c/details\u003e\n\n## Using OpenID Connect (OIDC) Authentication\n\nUsing OpenID Connect (OIDC) to authenticate your pipelines eliminates the need for long lived static credentials providing a whole range of [security and practical benefits](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration-benefits).   \nYou can read more about the [JFrog OpenID Connection Integration](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-integration) in the documentation.\n\nSetting up OpenID Connect has 3 separate parts:\n- Setting up an OpenID Connect Integration inside of the JFrog Platform.\n- Configuring Identity Mappings with Claim rules, matching to Projects \u0026 Service Connections.\n- Configuring Service Connections as OpenID Connect in the Projects in your Azure Devops Instance.\n\n\u003e [!IMPORTANT]\n\u003e To use OIDC authentication, make sure you're using **JFrog CLI version 2.75.0 or later**  \n\u003e and **JFrog Azure DevOps Extension version 2.11.0 or later**.\n\nFollow the guides below to configure each part.\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Configure OpenID Connect Integration\n\n\u003c/summary\u003e\n\n\nFirst, configure an OpenID Connect integration to your Azure DevOps server in your JFrog instance.\nLog in to your JFrog instance as an administrator,\nthen as [described in the documentation:](https://jfrog.com/help/r/jfrog-platform-administration-documentation/openid-connect-configurations-overview)\n\n1. Go to the **Administrator panel**.\n2. Select **General Management**.\n3. Choose **Manage Integrations**.\n4. Select New Integration - **OpenID Connect**\n\nNext, fill out the integration form with your Azure DevOps instance parameters.\n\n| Property name | Description                                                                           |\n| ------------- |---------------------------------------------------------------------------------------|\n| Provider Name | A name for your provider, this name is used in the Azure DevOps tasks in the pipelines. |\n| Provider Type | `Azure`                                                                               |\n| Description   | A description of what this provider is for.                                           |\n| Provider URL  | `https://vstoken.dev.azure.com/{ORG_GUID}` (see how to get the {ORG_GUID} below).     |\n| Audience      | example: `api://AzureADTokenExchange`                                                 |\n| Token Issuer  | If the issuer is different from the provider, for Azure DevOps this can be left blank. |\n\nFor example, the final integration configuration will look like this:\n\n![oidc-integration.png](images/oidc-integration.png)\n\nIn order to obtain your Azure DevOps Organization GUID (`{ORG_GUID}`) you can simply run a pipeline in your Azure DevOps organization using any of the JFrog Task setup using a Service Connection configured with the `OpenID Connect Integration` authentication method, see the [Configure the Service Connection](#configure-the-service-connection) section. Even if the task fails due to you not yet having configured the Integration in JFrog, it will output the relevant information as part of the pipeline.\n\nIn the Pipeline Output, look for the `OIDC Token Issuer`,value, which you need to enter as your `Provider URL`.\nThe rest of the information can also be helpful for you to configure the Identity Mappings as described in the section below.\n\n```\nOIDC Token Subject: sc://\u003cDevopsOrgName\u003e/\u003cProjectName\u003e/\u003cServiceConnectionName\u003e\nOIDC Token Claims: {\"sub\": \"sc://\u003cDevopsOrgName\u003e/\u003cProjectName\u003e/\u003cServiceConnectionName\u003e\"}\nOIDC Token Issuer: https://vstoken.dev.azure.com/xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\nOIDC Token Audience: api://AzureADTokenExchange\n```\n\n\u003e **Security Tip**: It's safe to log OpenID Connect claims like `sub`, `aud`, or `iss` in debug output for troubleshooting purposes.\n\u003e However, never print the full ID token or access token, even in debug logs.\n\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Configure Identity Mappings\n\n\u003c/summary\u003e\n\nWhen the `OpenID Connect Integration` has been configured, you must now configure `Identity Mappings` for your projects and service connections to allow them to utilize the integration.\nYou can find the full documentation for configuring [Identity Mappings in the Documentation](https://jfrog.com/help/r/jfrog-platform-administration-documentation/identity-mappings).\nFor this part we will focus on how to setup the JSON Claim which is used to map the JWT request of the pipeline to the access rights in your mapping.\n\nWhen working with OpenID Connect, we must look at the `ID Token` that our provider (Azure DevOps) outputs.\nBased on the information in the token, we can map properties into rules in our `Identity Mappings` JSON Claim.\nThe `ID Token` from the Azure DevOps token provider looks like this:\n\n```json\n{\n  \"jti\": \"\u003cguid\u003e\",\n  \"sub\": \"sc://\u003cDevopsOrgName\u003e/\u003cProjectName\u003e/\u003cServiceConnectionName\u003e\",\n  \"aud\": \"api://AzureADTokenExchange\",\n  \"iss\": \"https://vstoken.dev.azure.com/\u003cORG_GUID\u003e\",\n  \"nbf\": 1708639268,\n  \"exp\": 1708640467,\n  \"iat\": 1708639868\n}\n```\n\nRelative to most other `ID Token` providers, our options are fairly sparse, the only sensible option is using the subject (`\"sub\"`) field.\nThe claim mapping does support wildcards with the `*` operator.\n\nA sample JSON Claim mapping which maps a specified ServiceConnection in a specified Project in your Organization would look like this:\n\n![oidc-json-mapping.png](images/oidc-json-mapping.png)\n\nTo allow all projects in your Organization with a ServiceConnection with a specified name, you could replace MyProject with `*`.\nJust make sure to never replace your Organization name with a `*` operator as that would allow any Azure DevOps Organization to gain access to your instance.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Configure the Service Connection\n\n\u003c/summary\u003e\n\nYou must configure a `ServiceConnection` setting the `Authentication method` to `OpenID Connect Integration`.\n\nThis requires you to fill in the following inputs:\n\n| Property name                | Description                                                                                            |\n| ---------------------------- | ------------------------------------------------------------------------------------------------------ |\n| Server URL                   | The URL of your JFrog instance with the `/artifactory` path fx. (`https://my.jfrog.io/artifactory`) |\n| OpenID Connect Provider Name | The `Provider Name` you configured in the `Configure OpenID Connect Integration` step                  |\n| Platform URL                 | The URL of your JFrog instance fx. (`https://my.jfrog.io/`)                                         |\n| Service connection name      | The name of the Service Connection, must match the values put into the `JSON Claims mapping`           |\n| Description (optional)       | A short of the purpose of this ServiceConnection                                                       |\n\n\nA sample configuration would look like this:\n\n![oidc-service-connection.png](images/oidc-service-connection.png)\n\nNow this Service Connection can be used for any of JFrog tasks as normal, authenticating with a temporary access token each time the pipeline runs.\n\n\u003e 💡 **Tip**  \n\u003e The extension automatically exports the authenticated user and access token\n\u003e as step outputs named `oidc_user` and `oidc_token`. These outputs can be used in later steps (e.g., for Docker login, Helm registry, or custom scripts).\n\u003e Example usage in a later step:\n\n```yaml\n steps:\n - task: JfrogCliV2@1\n   inputs:\n     jfrogPlatformConnection: 'azure-oidc'\n     command: 'jf rt ping'\n \n - task: PowerShell@2\n   inputs:\n     targetType: 'inline'\n     script: |\n            echo \"OIDC Username (from output): $(oidc_user)\"\n            echo \"OIDC Token (from output): $(oidc_token)\"\n   displayName: 'Use OIDC Output Variables'\n```\n\n\nSee [JFrog CLI - OIDC Token Exchange (`jf eot`)](https://jfrog.com/help/r/jfrog-cli/jfrog-cli-eot) for more information on how the CLI handles OpenID Connect tokens behind the scenes.\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n\n\n## Executing JFrog CLI Commands\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### JFrog CLI V2 Task\n\u003c/summary\u003e\n\nThe extension support a generic [JFrog CLI](https://jfrog.com/help/r/jfrog-cli/jfrog-cli) task, named *JFrog CLI V2*,\nwhich allows executing *[JFrog CLI](https://jfrog.com/help/r/jfrog-cli/jfrog-cli)* commands.\nThe command will use the connection details provided by the selected *JFrog Platform* service connection configured in\nAzure DevOps,\nso there's no need to provide the connection details as command options.\n\n![cli-v2-task.png](images/cli-v2-task.png)\n\nSingle command example:\n\n```YAML\n- task: JfrogCliV2@1\n  inputs:\n    jfrogPlatformConnection: 'JFrog Platform V2'\n    command: |\n- task: JfrogCliV2@1\n  inputs:\n    jfrogPlatformConnection: 'JFrog Platform V2'\n    command: |\n      jf go-config --repo-resolve=go-remote --repo-deploy=go-local \n      jf go build \n      jf go-publish v1.0.0\n      jf rt bce $(Build.DefinitionName) $(Build.BuildNumber)\n      jf rt build-publish $(Build.DefinitionName) $(Build.BuildNumber)\n```\n\nMultiple commands example:\n\n```YAML\n- task: JfrogCliV2@1\n  inputs:\n    jfrogPlatformConnection: 'JFrog Platform V2'\n    command: |\n      jf rt ping\n      jf terraform-config --repo-deploy=terraform-remote \n      jf terraform publish --namespace=example --provider=aws --tag=v0.0.1\n```\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Managing Generic Artifacts\n\n\u003cdetails\u003e\n  \u003csummary\u003eJFrog Generic Artifacts task\u003c/summary\u003e\n\nThe *JFrog Generic Artifacts* task supports following operations with JFrog Artifactory:\n\n* Uploading artifacts to Artifactory\n* Downloading artifacts from Artifactory\n* Copying artifacts in Artifactory\n* Moving artifacts in Artifactory\n* Deleting artifacts in Artifactory\n* Setting properties on artifacts in Artifactory\n* Deleting properties from artifacts in Artifactory\n\nThe task triggers [JFrog CLI](https://jfrog.com/help/r/jfrog-cli/jfrog-cli) to perform these actions\nusing [File Specs](https://jfrog.com/help/r/jfrog-integrations-documentation/using-file-specs).\nWhen the task is used for uploading and downloading artifacts, it can also be configured to capture the build-info,\nwhich can be later published to Artifactory using the *JFrog Publish Build Info* task.\n\nWhen configuring the task, do the following:\n\n1. Select your configured *JFrog Artifactory V2* service connection.\n\n2. Specify whether you'd like define the File Spec through the task UI or have the task read the spec from a file.\n\n3. Set the File Spec content or a path to the File Spec.\n\n4. Set the other task options.\n\n5. Check the *Advanced* section for additional options.\n\n### Generic artifacts handling\n\nThe *JFrog Generic Artifacts* task allows performing generic actions on artifacts, such as:\n\n1. Downloading and uploading from/to Artifactory\n2. Setting or deleting properties on artifacts in Artifactory\n3. Moving, copying and deleting artifacts in Artifactory\n\n### Downloading generic build dependencies from Artifactory\n\nThe task supports downloading your build dependencies from Artifactory to the build agent.\nThe downloaded dependencies are defined\nusing [File Specs](https://jfrog.com/help/r/jfrog-integrations-documentation/using-file-specs)\nand can be also configured to capture the build-info.\nIt will store the downloaded files as dependencies in the build-info which can later be published to Artifactory using\nthe *JFrog Publish Build-Info* task.\n\n![GenericDownload](images/marketplace/generic-download.png)\n\n### Uploading generic build artifacts to Artifactory\n\nThe task also supports uploading your generated build artifacts from the build agent's local file system to Artifactory.\nThe artifacts are defined\nusing [File Specs](https://jfrog.com/help/r/jfrog-integrations-documentation/using-file-specs).\nThe task can be also configured to capture build-info and stores the uploaded files as artifacts in the build-info. The\ncaptured build-info can be later published to Artifactory using the *JFrog Publish Build-Info* task.\n\n![GenericUpload](images/marketplace/generic-upload.png)\n\n### Setting / Deleting properties on files in Artifactory\n\nThe JFrog Generic Artifacts task also allows both setting and deleting properties on artifacts in Artifactory.\n\n![Props](images/marketplace/props.png)\n\n### Moving / Copying / Deleting artifacts in Artifactory\n\nSame task also allows performing generic actions on artifacts in Artifactory.\n\n![Copy](images/marketplace/move-copy-delete.png)\n\nYAML Example:\n\n```YAML\n- task: JFrogGenericArtifacts@1\n  inputs:\n    command: 'Upload'\n    connection: 'jfrog artifactory'\n    specSource: 'taskConfiguration'\n    fileSpec: |\n      {\n        \"files\": [\n          {\n            \"pattern\": \"libs-generic-local/*.zip\",\n            \"target\": \"dependencies/files/\"\n          }\n        ]\n      }\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    projectKey: 'proj'\n    includeEnvVars: true\n    failNoOp: true\n```\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Build tools Tasks\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Maven Task\n\u003c/summary\u003e\n\n![mvn.png](images/marketplace/mvn.png)\n\nThe *JFrog Maven* task allows triggering Maven builds, while resolving dependencies and deploying artifacts from and\nto Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nThe task can also be configured to capture build-info and store the downloaded and uploaded artifacts as build\ndependencies and build artifacts.\nThe captured build-info can be later published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\n\n![mvn.png](images/maven-task.png)\n\nYou also have the option of filtering out some of the Maven artifacts that will be deployed to Artifactory.\nYou do this by defining one or more include patterns. You can also define one or more exclude patterns.\nThe patterns can include wildcards and should be separated by a comma followed by a white-space as shown below.\n\n![mvn.png](images/maven-filter.png)\n\n```YAML\n- task: JFrogMaven@1\n  inputs:\n    mavenPomFile: 'pom.xml'\n    goals: 'install'\n    artifactoryResolverService: 'jfrog artifactory'\n    targetResolveReleaseRepo: 'libs-release'\n    targetResolveSnapshotRepo: 'libs-snapshot'\n    artifactoryDeployService: 'jfrog artifactory'\n    targetDeployReleaseRepo: 'libs-release'\n    targetDeploySnapshotRepo: 'libs-snapshot'\n    filterDeployedArtifacts: true\n    includePatterns: 'artifact-*.jar,artifact-*.pom'\n    excludePatterns: 'artifact-*-test.jar,artifact-*-test.pom'\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    includeEnvVars: true\n```\n\nFor more information about Maven repositories,\nsee [Artifactory Maven Repository](https://jfrog.com/help/r/jfrog-artifactory-documentation/maven-repository)\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Gradle Task\n\u003c/summary\u003e\n\n![gradle.png](images/marketplace/gradle.png)\n\nThe *JFrog Gradle* task allows triggering Gradle builds, while resolving dependencies and deploying artifacts from and\nto Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\n\nThe task can also be configured to capture build-info and store the downloaded and uploaded artifacts as build\ndependencies and build artifacts.\nThe captured build-info can be later published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\n\nBehind the scenes, the *JFrog Gradle* task uses\nthe [Gradle Artifactory Plugin](https://jfrog.com/help/r/jfrog-integrations-documentation/gradle-artifactory-plugin) to\nintegrate with the Gradle build.\nIn case your Gradle script already applies\nthe [Gradle Artifactory Plugin](https://jfrog.com/help/r/jfrog-integrations-documentation/gradle-artifactory-plugin),\nset the *Use Artifactory Plugin* option, to let the task know that it shouldn't apply the plugin in the Gradle script.\n\nYou should set *artifactoryPublish* as one of the Gradle tasks in the task(s) fields.\n*artifactoryPublish* is a task that is exposed by the Gradle Artifactory Plugin, and is used for deploying artifacts\nas well as publishing build-info to Artifactory.\n\n\u003e **Note:** Starting with Gradle 9, the `gradleBuildFile` parameter is not respected due to changes in how Gradle handles build file specification. However, this parameter is still required for Gradle versions 8 and below. The task automatically detects the Gradle version and adjusts its behavior accordingly.\n\n![gradle.png](images/gradle-task.png)\n\n```YAML\n- task: JFrogGradle@1\n  inputs:\n    gradleBuildFile: 'build.gradle'\n    tasks: 'artifactoryPublish'\n    artifactoryResolverService: 'jfrog artifactory'\n    sourceRepo: 'gradle-virtual'\n    artifactoryDeployerService: 'jfrog artifactory'\n    targetRepo: 'gradle-local'\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Npm Task\n\u003c/summary\u003e\n\n![npm.png](images/marketplace/npm.png)\n\nThe *JFrog Npm* task allows triggering npm builds, while resolving npm dependencies and deploying npm packages from\nand to Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\n\nThe task can be also configured to capture build-info and store the uploaded files as artifacts in it.\nThe captured build-info can be later published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\n\n![npm.png](images/npm-task.png)\n\n```YAML\n- task: JFrogNpm@1\n  inputs:\n    command: 'install'\n    artifactoryConnection: 'jfrog artifactory'\n    sourceRepo: 'npm-virtual'\n    collectBuildInfo: true\n    threads: '1'\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    includeEnvVars: true\n```\n\nFor information on npm repositories,\nsee [Artifactory npm Registry](https://jfrog.com/help/r/jfrog-artifactory-documentation/npm-registry)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Nuget and .NET Core Task\n\u003c/summary\u003e\n\n\n![nuget.png](images/marketplace/nuget.png)\n\nThe *JFrog Nuget* and *JFrog .NET Core* tasks allow restoring NuGet packages from Artifactory.\nThese tasks also allow publishing NuGet packages to Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nThe tasks can be configured to capture build-info.\nThe build-info stores the restored packages as build dependencies and uploaded packages as build artifacts.\nThe captured build-info can be later published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\n\n![nuget.png](images/nuget-task.png)\n\n```YAML\n- task: JFrogDotnetCore@1\n  inputs:\n    command: 'restore'\n    artifactoryConnection: 'jfrog artifactory'\n    targetResolveRepo: 'nuget-virtual'\n    rootPath: '*/*.sln'\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    includeEnvVars: true\n```\n\nFor more information about Nuget repositories,\nsee [Artifactory NuGet Repositories](https://jfrog.com/help/r/jfrog-artifactory-documentation/nuget-repositories)\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Pip Task\n\u003c/summary\u003e\n\n![pip.png](images/marketplace/pip.png)\n\nThe *JFrog Pip* task allows installing Pip packages from Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nThe tasks can also be configured to capture build-info. The build-info stores the installed packages as build\ndependencies.\nThe captured build-info can be later published to Artifactory using\nthe [Publishing Build Info to Artifactory](http://www.jfrog.com#PublishingBuildInfotoArtifactory) task.\n\n![pip.png](images/pip-task.png)\n\n```YAML\n- task: JFrogPip@1\n  inputs:\n    artifactoryConnection: 'jfrog artifactory'\n    command: 'install'\n    targetResolveRepo: 'pypi'\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n```\n\n*Recording all dependencies as part of the build-info*\nWhen running the *JFrog Pip* task inside a Python environment, which already has some of the packages installed, the\ninstalled packages will not be included as part of the build-info, if they were not originally installed from\nArtifactory. A warning message will be added to the build log in this case.\n\n*How to include all packages in the build-info?*\nRunning the task for the first time with the *Disable local pip cache* option checked,\nshould re-download and install these packages, and they will therefore be included in the build-info.\nIt is also recommended to run the command from inside\na [virtual environment](https://packaging.python.org/guides/installing-using-pip-and-virtual-environments/).\nThe *Virtual environment setup command* field allows this.\n\n![pip-advanced.png](images/pip-advanced.png)\n\nBehind the scenes, the task uses JFrog CLI as a wrapper for pip.\nJFrog CLI also includes a caching mechanism, which stores the details of the dependencies locally, making sure they are\nincluded in the build-info, even if they are already cached locally.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Conan Task\n\u003c/summary\u003e\n\n![conan.png](images/marketplace/conan.png)\n\n[Conan](https://conan.io/) is a package manager for C and C++.\n\nThe *JFrog Conan* task allows triggering a conan build while resolving conan dependencies from a conan repository in\nArtifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nIt also allows publishing conan packages to an Artifactory conan repository.\nThe task can be also configured to capture build-info and store the downloaded and uploaded packages as build\ndependencies and artifact.\nThe captured build-info can be later published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\n\nThe task supports the *config install* , *add remote* , *create* and *upload* conan commands.\nIn addition, it supports a *custom* option, allowing to configure the task to execute any conan command.\nThe full documentation of Conan is available at the [conan website](https://docs.conan.io/en/latest/).\n\n![conan.png](images/conan-task.png)\n\n```YAML\n- task: JFrogConan@1\n  inputs:\n    conanCommand: 'Install'\n    pathOrReference: './'\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n```\n\nFor more information about Conan repositories,\nsee [Artifactory Conan Repositories](https://jfrog.com/help/r/jfrog-artifactory-documentation/conan-repositories)\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Go Task\n\u003c/summary\u003e\n\nThe *JFrog Go* task allows triggering a go build, while resolving go dependencies from a go repository in Artifactory.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nIt also allows publishing go packages to an Artifactory go repository.\nThe task can be also configured to capture build-info and store the downloaded and uploaded packages as build\ndependencies and artifact.\nThe captured build-info can be later published to Artifactory using the *JFrog Publish Build-Info* task.\n\n![go.png](images/go-task.png)\n\n```YAML\n- task: JFrogGo@1\n  inputs:\n    command: 'build'\n    artifactoryConnection: 'jfrog artifactory'\n    resolutionRepo: 'go'\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    includeEnvVars: true\n    workingDirectory: 'golang-example/hello'\n```\n\nFor more information about Go repositories,\nsee [Artifactory Go Repositories](https://jfrog.com/help/r/jfrog-artifactory-documentation/go-registry)\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Build Tasks\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Collect Build Issues\n\u003c/summary\u003e\n\nBeing able to look at the build which was published to Artifactory, and see all JIRA issues associated with it, is one\nof the most powerful capabilities of Artifactory when it comes to managing metadata about artifacts builds.\n\nThe *JFrog Collect Build Issues* task collects the list of tracked project issues (for example, issues stored in JIRA,\nGitHub or any other bug tracking systems, and adds these issues to the build-info.\nThe task uses the configured *JFrog Artifactory V2* service connection. The issues are collected by reading the git\ncommit messages from the local git log.\nEach commit message is matched against a pre-configured regular expression, which retrieves the issue ID and issue\nsummary.\nThe information required for collecting the issues is retrieved from a yaml configuration, which is set as part for the\ntask.\n\n![collect-issues.png](images/collect-issues.png)\n\nHere's the yaml configuration structure.\n\n```YAML\nversion: 1\nissues:\n  trackerName: JIRA\n  regexp: (.+-[0-9]+)\\s-\\s(.+)\n  keyGroupIndex: 1\n  summaryGroupIndex: 2\n  trackerUrl: https://my-jira.com/issues\n  aggregate: true\n  aggregationStatus: RELEASED\n```\n\n##### Configuration properties\n\n| Property name     | Description                                                                                                                                                                                                                                                                                                             |\n|-------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|\n| Version           | The schema version is intended for internal use. Do not change!                                                                                                                                                                                                                                                         |\n| trackerName       | The name (type) of the issue tracking system. For example, JIRA. This property can take any value.                                                                                                                                                                                                                      |\n| regexp            | A regular expression used for matching the git commit messages. The expression should include two capturing groups - for the issue key (ID) and the issue summary. In the example above, the regular expression matches the commit messages as displayed in the following example:\u003cbr\u003eHAP-1007 - This is a sample issue |\n| keyGroupIndex     | The capturing group index in the regular expression used for retrieving the issue key. In the example above, setting the index to \"1\" retrieves HAP-1007 from this commit message:\u003cbr\u003eHAP-1007 - This is a sample issue                                                                                                 |\n| summaryGroupIndex | The capturing group index in the regular expression for retrieving the issue summary. In the example above, setting the index to \"2\" retrieves the sample issue from this commit message:\u003cbr\u003eHAP-1007 - This is a sample issue                                                                                          |\n| trackerUrl        | The issue tracking URL. This value is used for constructing a direct link to the issues in the Artifactory build UI.                                                                                                                                                                                                    |\n| aggregate         | Set to true, if you wish all builds to include issues from previous builds.                                                                                                                                                                                                                                             |\n| aggregationStatus | If aggregate is set to true, this property indicates how far in time should the issues be aggregated. In the above example, issues will be aggregated from previous builds, until a build with a RELEASE status is found. Build statuses are set when a build is promoted using the jfrog rt build-promote command.     |\n\nThe yaml configuration can be either be stored as text as part of the task configuration, or stored in a file.\nThe file can be saved in the source control, and fetched, together with the rest of the sources to the build agent.\nIt can then be accesses and used by this task.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Publish Build Info\n\u003c/summary\u003e\n\nMost of the JFrog tasks can be configured to collect and store build-info locally.\nThe task uses the configured *JFrog Artifactory V2* service connection.\nThe collected build info can be then published to Artifactory using the *JFrog Publish Build Info* task.\n\nFor more information about Build Info,\nsee [Artifactory Build Integration](https://jfrog.com/help/r/jfrog-cli/build-integration)\n\nWhen configuring the task, select your configured Artifactory service endpoints and specify whether you'd like to\ncollect environment variables from the agent and add them to the build-info.\n\n![collect-issues.png](images/marketplace/build-publish.png)\n\n```YAML\n- task: JFrogPublishBuildInfo@1\n  inputs:\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    excludeEnvVars: '*password*;*psw*;*secret*;*key*;*token*;*auth*;'\n```\n\nAfter the build-info is published to Artifactory, it can be accessed from the *Artifactory* tab in the Build Results.\n\n![build-results.png](images/marketplace/build-results.png)\n![bi-in-artifactory.png](images/marketplace/bi-in-artifactory.png)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Build Promotion\n\u003c/summary\u003e\n\n\nTo support the artifacts life-cycle, Artifactory supports promoting published builds from one repository to another.\n\nThe *JFrog Build Promotion* task promotes a build, by either copying or moving the build artifacts and/or dependencies\nto a target repository.\n\nThis task can be added as part of a Build or Release pipeline.\n\nRun these steps to configure the *JFrog Build Promotion* task:\n\n1. Select the configured *JFrog Artifactory V2* service connection, to which the build has been published.\n\n2. Specify the name of a* target repository* to which the build should be promoted.\n\n3. Set the *status* of the build and optionally add a *Comment*. These details will be visible as part of the Build\n   History in the Artifactory UI.\n\n4. (Optional) Set a *source repository* for the promotion.\n\n5. Select the *include build dependencies* if you want the build dependencies to be promoted.\n\n6. To copy and not to move the artifacts to the target repository, select the *Use copy* option to copy the artifacts\n   to the target repository.\n\n7. Select *Dry run* to test the promotion prior to running the build promotion.\n\n![build-promotion.png](images/marketplace/build-promotion.png)\n\n```YAML\n- task: JFrogBuildPromotion@1\n  inputs:\n    artifactoryConnection: 'jfrog artifactory'\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    targetRepo: 'staging-local'\n    status: 'Released'\n    comment: 'Promoting release candidate'\n    sourceRepo: 'Dev1-local'\n    includeDependencies: false\n    copy: true\n    dryRun: false\n```\n\n##### Using Build Promotion in a Release\n\nYou can control the life cycle of your artifacts by promoting them from one Artifactory repository to another.\nBuild Promotion can come in handy when embedding it as part of release pipeline in Azure DevOps.\nTo help you achieve this, follow these steps for creating a release which includes the *JFrog Build Promotion* task.\n\n1. Create a new Release.\n   ![promotion.png](images/promotion1.png)\n2. Click *environment* and select a template for the release.\n   ![promotion.png](images/promotion2.png)\n3. Click *Artifact* and select *Build* as the source type.\n4. Fill out the rest of the form details.\n5. If you'd like this release to always use the latest build from Artifactory, select specify a specific build number\n   as the *Default version* and select one of the available build number i the *Build number* list box.\n6. If you'd like to promote a specific build number during the release, select specify at the time of release\n   creation as the *Default version*:\n   ![promotion.png](images/promotion3.png)\n7. If you wish to promote the latest build number, select specify a specific build number as the *Default version*\n   and then select *any* build number. Then, click on the *Variables* tab and add\n   the *ARTIFACTORY_RELEASE_BUILD_NUMBER* pipeline variable with *LATEST* as the value.\n   ![promotion.png](images/promotion4.png)\n8. Configure the *Artifactory Build Promotion* task as one of your release pipeline tasks.\n   The task uses a build number which will be selected later on, upon creating a release.\n   ![promotion.png](images/promotion5.png)\n9. That's it, you're done!\n   Now you can create the release. The build number that you'll choose is that one which will be promoted in\n   Artifactory.\n   ![promotion.png](images/promotion6.png)\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### Discarding Published Builds from Artifactory\n\u003c/summary\u003e\n\nTo discard old runs of a build from Artifactory, add the *JFrog Discard Builds* task to the pipeline.\n\nRun these steps to configure the task.\n\n1. Select the configured *JFrog Artifactory V2* service connection, on which you'd like the builds to be discarded.\n\n2. Type the name of the build.\n\n3. Optionally set the maximum days to keep build runs. Build runs which are older will be discarded.\n\n4. Optionally set the maximum number of builds to keep.\n\n5. Optionally set of build runs in the form of 10,11,12,... to keep and not to discard.\n\n6. Check the Delete artifacts checkbox, to also delete the build artifacts and not only the build meta-data.\n\n7. Check the Async checkbox, to make the action asynchronous. In this case, the pipeline will not wait for the action to\n   finish, but the pipeline will not be notified in case of a failure.\n   ![build-discard.png](images/marketplace/discard.png)\n\n```YAML\n- task: JFrogDiscardBuilds@1\n  inputs:\n    artifactoryConnection: 'jfrog artifactory'\n    buildName: '$(Build.DefinitionName)'\n    maxDays: '60'\n    maxBuilds: '400'\n    excludeBuilds: '10,11,12'\n    deleteArtifacts: true\n```\n\n\u003c/details\u003e\n\n\u003cbr\u003e\n\n## JFrog Xray tasks\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### Audit project's dependencies for Security Vulnerabilities\n\u003c/summary\u003e\n\n\nThe *JFrog Audit* task triggers an audit of your project dependencies for security vulnerabilities with JFrog Xray.\nThe task uses the configured *JFrog Xray V2* service connection.\nThe scan is synchronous, meaning the tasks waits for the scan to finish.\nTo determine the policy for identifying the vulnerabilities, you can either set a list for Xray Watches or select a\nJFrog Project or path in Artifactory associated with the policy.\n\n\u003e This functionality requires version 3.29.0 or above of JFrog Xray.\n\n![audit.png](images/marketplace/audit.png)\n![violations-table.png](images/marketplace/violations-table.png)\n\n```YAML\n- task: JFrogAudit@1\n  inputs:\n    xrayConnection: 'jfrog xray token'\n    watchesSource: 'watches'\n    watches: 'watch1,watch2'\n    allowFailBuild: true\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### Scanning Published Builds for Security Vulnerabilities\n\u003c/summary\u003e\n\nThe *JFrog Build Scan* task allows triggering a build scan with JFrog Xray.\nFor the build to be scanned, it first needs to be published to Artifactory using the *[JFrog Publish Build-Info](#JFrog-Publish-Build-Info)* task.\nThe task uses the configured *JFrog Xray V2* service connection.\nWhen the scan is triggered, Xray starts scanning the build artifacts and dependencies.\nThe scan is synchronous, meaning the tasks waits for the scan to finish.\nIf the *Allow fail build* task option is set and Xray is configured to fail the build, the build pipeline will fail,\nif vulnerabilities are found.\n\n\u003e This functionality requires version 3.37.0 or above of JFrog Xray.\n\n![build-scan.png](images/marketplace/build-scan.png)\n\n```YAML\n- task: JFrogBuildScan@1\n  inputs:\n    xrayConnection: 'jfrog xray token'\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    allowFailBuild: true\n    vuln: false\n```\n\nAfter the Xray scan is completed, a vulnerabilities table is printed to the task run logs, along with a link to the\nbuild-info report.\n\n![violations-table.png](images/marketplace/violations-table.png)\n![violations-table.png](images/xray-scan-results.png)\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## JFrog Docker tasks\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### Pushing and Pulling Docker Images to and from Artifactory\n\u003c/summary\u003e\n\nThe *JFrog Docker* task allows pushing and pulling docker images to and from a docker repository in Artifactory.\nThe task can be also configured to capture build-info for the pushed or pulled image.\nIn addition to details about the build and the build environment, the build info includes the image layers as build\ndependencies and build artifacts.\nThe task stores build info locally on the build agent.\nThe stored build-info can be later published to Artifactory using the *JFrog Publish Build Info* task.\n\n\u003e This functionality requires version 7.33.3 or above of Artifactory.\n\nFor more information about Docker and Artifactory,\nsee [Artifactory Docker Registry](https://jfrog.com/help/r/jfrog-artifactory-documentation/docker-registry)\n\n![docker-pull.png](images/marketplace/docker-pull.png)\n\n```YAML\n- task: JFrogDocker@1\n  inputs:\n    command: 'Pull'\n    artifactoryConnection: 'jfrog artifactory'\n    imageName: 'myjfrog.jfrog.io/docker-local/hello-world:latest'\n    collectBuildInfo: true\n    buildName: '$(Build.DefinitionName)'\n    buildNumber: '$(Build.BuildNumber)'\n    skipLogin: false\n```\n\n\u003c/details\u003e\n\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### Scanning Local Docker Images with JFrog Xray\n\u003c/summary\u003e\n\nThe *JFrog Docker* task allows scanning local docker images using JFrog Xray. The scan results is displayed in the\nbuild log.\n\nBy default, the result will include all vulnerabilities found. You may however configure the task to show only\nviolations configured in Xray.\n\nYou do this by configuring the task to use:\n\n1. Your JFrog Project. If there are Xray Watches associated with this Project, these Watches will be used.\n\n2. Xray Watch or a list of Watches.\n\n3. Repository path in Artifactory which has Xray Watches associated with it.\n\n\u003e This functionality requires version 3.40.0 or above of JFrog Xray.\n\n![docker-scan.png](images/marketplace/docker-scan.png)\n\n```YAML\n- task: JFrogDocker@1\n  inputs:\n    command: 'Scan'\n    xrayConnection: 'jfrog xray token'\n    watchesSource: 'none'\n    licenses: true\n    allowFailBuild: true\n    threads: '3'\n    skipLogin: false\n```\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Using Published Artifacts in a Release\n\n\nArtifacts which were published to Artifactory can be made available for a Release Pipeline.\nThere are two ways to achieve this:\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Using JFrog Generic Artifacts task\n\u003c/summary\u003e\n\nThe first way is to use the [JFrog Generic Artifacts](#Managing-Generic-Artifacts) task to download the files during the\nrelease. Read more about this in\nthe Downloading Generic Dependencies from Artifactory section.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003e\n\n#### Using Azure Artifact source\n\u003c/summary\u003e\n\nYou can also set Artifactory as an artifact source for the release.\nThis allows downloading the artifacts for a build which was previously published to Artifactory.\nRead more about publishing builds to Artifactory in the Publishing Build\nInfo to Artifactory section.\n\nFollow these steps to add Artifactory as an artifact source to a Release.\n\n1. Create a new Release and click on *Artifacts Add*\n\n   ![release1.png](images/release1.png)\n\n2. Select the *Artifactory* source type.\n\n   ![release2.png](images/release2.png)\n\n3. Select an Artifactory service, a build name, and the default version to use.\n\n   ![release3.png](images/release3.png)\n\n   That's it! You're done.\n\n   Now, when initiating the Release, the artifacts associated with the defined build are downloaded to the release\n   agent.\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Managing and Distributing Release Bundles\n\n\u003cdetails\u003e\n  \u003csummary\u003e \n\n#### JFrog Distribution V2 Task\n\u003c/summary\u003e\n\n[JFrog Distribution](https://jfrog.com/help/r/jfrog-distribution-documentation) is a centralized platform that lets you\nprovision software release distribution.\nIt is a core part of JFrog Enterprise+,\nmanaging [Release Bundles](https://jfrog.com/help/r/jfrog-distribution-documentation/distributing-release-bundles) and\ntheir distribution processes,\nincluding release content, permission levels, and target destinations.\nDistribution provides a secure and structured platform to distribute release binaries to multiple remote locations and\nupdate them as new release versions are produced.\nAs part of the release flow, release bundles are verified by the target destination to ensure that they are signed\ncorrectly and safe to use.\nJFrog DistributionDistributing Release Bundles\n\nThe *JFrog Distribution* task allows creating, updating, signing and deleting release bundles.\nIt also allows distributing the release to the edge nodes.\n\n* The task requires configuring your *JFrog Distribution V2* instance as a service connection in Azure DevOps.\n* You can then set the instance you configured as the Distribution service value in the task.\n* The task triggers [JFrog CLI](https://jfrog.com/help/r/jfrog-cli/jfrog-cli) to execute the distribution actions.\n* When creating or updating a release bundle, you need to\n  provide [File Specs](https://jfrog.com/help/r/jfrog-integrations-documentation/using-file-specs) defining the\n  artifacts to be included in the release bundle.\n* When distributing a release bundle, you can control the distribution destinations by defining rules distribution rules\n  in a JSON format.\n\n*Distribution Rules JSON structure* Here's an example:\n\n```JSON\n   {\n  \"distribution_rules\": [\n    {\n      \"site_name\": \"DC-1\",\n      \"city_name\": \"New-York\",\n      \"country_codes\": [\n        \"1\"\n      ]\n    },\n    {\n      \"site_name\": \"DC-2\",\n      \"city_name\": \"Tel-Aviv\",\n      \"country_codes\": [\n        \"972\"\n      ]\n    }\n  ]\n}\n```\n\nThe Distribution Rules format also supports wildcards. For example:\n\n```JSON\n   {\n  \"distribution_rules\": [\n    {\n      \"site_name\": \"*\",\n      \"city_name\": \"*\",\n      \"country_codes\": [\n        \"*\"\n      ]\n    }\n  ]\n}\n```\n\n![distribution.png](images/marketplace/distribution.png)\n\n```YAML\n- task: JFrogDistribution@1\n  inputs:\n    command: 'distribute'\n    distributionConnection: 'distCon'\n    rbName: 'myReleaseBundle'\n    rbVersion: '$(Build.BuildNumber)'\n    distRulesSource: 'taskConfiguration'\n    distSync: true\n    maxWaitSync: '40'\n```\n\n\u003c/details\u003e\n\n\n\u003cbr\u003e\n\n## Contribution\n\n\nWe welcome pull requests from the community!\n\n\u003cdetails\u003e\n    \u003csummary\u003eBuilding\u003c/summary\u003e\n\n### Building\n\nTo build and run the extension sources, please follow these steps:\n\n1. Clone the code from git.\n2. To Build and create the JFrog Artifactory extension `vsix` file, run the following command.\n    ```\n    npm i\n    npm run create\n    ```\n\nAfter the build process is completed, you'll find the `vsix` file in the project directory.\nThe `vsix` file can be loaded into Azure DevOps and TFS.\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003eTesting\u003c/summary\u003e\n\n### Testing\n\nTo run the tests, please make sure you are using node 14 or above.\n\nUse the following commands to run from terminal:\n\n1. Set the ADO_JFROG_PLATFORM_URL, ADO_JFROG_PLATFORM_USERNAME and ADO_JFROG_PLATFORM_PASSWORD environment variables\n   with your JFrog Platform URL, username and password:\n    ```\n    export ADO_JFROG_PLATFORM_URL='https://myrepo.jfrog.io/'\n    export ADO_JFROG_PLATFORM_USERNAME=admin\n    export ADO_JFROG_PLATFORM_PASSWORD=password\n    ```\n\n2. Run the following commands:\n    ```\n    npm i -g jfrog-cli-v2-jf\n    npm t\n    ```\n\nNote: If you are running tests via your IDE, make sure you are registering tests with\nts-node: `mocha -r ts-node/register tests.ts -t 1000000`.\n\n#### Skipping Tests\n\nIn order to skip tests, set the ADO_SKIP_TESTS environment variable with the tests you wish to skip, separated by\ncommas.\nThe supported values are: *maven*, *gradle*, *npm*, *go*, *nuget*, *dotnet*, *conan*, *pip*, *proxy*,\n*distribution*, *unit*, *installer* and *generic*.\n\nFor example, for skipping the nuget and dotnet tests:\n\n```\nexport ADO_SKIP_TESTS=nuget,dotnet\n```\n\n\u003c/details\u003e\n\n\u003cdetails\u003e\n    \u003csummary\u003ePull request guidelines\u003c/summary\u003e\n\n* Pull requests should be created on the *dev* branch.\n* Please make sure the code is covered by tests.\n* Please run `npm run format` for formatting the code before submitting the pull request.\n* Please run `npm run lint` and make sure no new tslint warnings were introduced.\n\n\u003c/details\u003e\n\n## Reporting issues\n\nPlease help us improve jfrog-azure-devops-extension by [reporting issues](https://github.com/jfrog/jfrog-azure-devops-extension/issues/new/choose) you encounter.\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjfrog%2Fjfrog-azure-devops-extension","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fjfrog%2Fjfrog-azure-devops-extension","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fjfrog%2Fjfrog-azure-devops-extension/lists"}