Code and binaries, finally on the same page
Software delivery pipelines have always been split between two worlds: the source code that developers write and the binary artifacts that actually get deployed. That split forces engineers, security teams, and DevOps staff to jump between tools, manually reconcile versions, and stitch together provenance data from disparate systems. A new partnership between GitHub and JFrog aims to close that gap.
The two companies have built an integration that spans navigation, CI/CD, and security visibility across both platforms. For JFrog customers already on GitHub—about half of them—this means managing source and binaries from a single dashboard without context switching. The integration covers SSO and role mapping, artifact lifecycle tracking between GitHub Actions and JFrog Artifactory, and bidirectional linking between code and built packages.
What the integration actually does
One identity layer for both platforms
Centralized access management is the foundation. Single sign-on (SSO), project role mapping, and access controls are synchronized across GitHub and JFrog, so user and permission changes made on one side automatically propagate to the other. No more juggling separate logins or manually mirroring team structures.
The world of software supply chain management introduces many challenges and points of friction for developers. The integration between JFrog's Software Supply Chain Platform and GitHub's Developer Platform was designed to provide a 'secure by default' developer experience. This collaboration gives developers a single source of truth for code and binaries, and security teams gain full traceability and a unified view to monitor and remediate threats, reducing risk.
Artifacts get full lifecycle tracking
The GitHub Actions and JFrog Artifactory integration goes beyond simple uploads. Binary artifacts produced by Actions now carry metadata about their build processes directly within Artifactory. That makes each artifact a first-class entity in software bill of materials (SBOM) generation, rather than an opaque file with no associated context.
We are thrilled to see some of the enhancements come to life; we believe this collaboration between GitHub and JFrog has the potential to significantly impact the DevOps landscape. For instance, establishing bidirectional links between GitHub Actions Workflows and Release Artifacts created and stored in Artifactory could enhance the development experience and traceability across the software supply chain.
Traceability in both directions
Governance and compliance require knowing exactly what source produced a given binary—and vice versa. The integration natively links code to built packages, enabling precise tracking and triage. Security and compliance teams get deeper provenance data to attest to where an artifact came from and how it was built.
What’s on the roadmap
The initial release is just the first step. JFrog and GitHub have outlined two major additions in the pipeline.
- Unified security view: Security findings from both platforms will be aggregated into GitHub dashboards, giving teams a holistic picture of software supply chain security without switching between tools.
- Copilot integration: JFrog systems will be accessible through GitHub Copilot Chat, allowing developers to ask questions about artifacts, processes, configuration, and even recommendations for package versions—bringing the assistant beyond source code into the artifact layer.
Beyond DevOps and DevSecOps practices, the future will require advanced interactions with AI tools. Chatting with GitHub Copilot to select the right and secure software package based on the extensive metadata stored in JFrog Catalog can be a game-changer. This integration will significantly enhance the efficiency of Copilot users across the software supply chain; binary-focused and code environments. This partnership offers the best of both worlds.
