Closing the gap between source and binary

Developers shipping at scale often lose sight of the connection between a commit and the artifact it produces. That link is also where security visibility tends to fracture: code scanners and binary scanners operate in separate silos, so reconciling their results is manual work. A new GitHub–JFrog integration aims to close that gap by tying the two platforms together into a single workflow where commits, builds, attestations, and vulnerability data stay in context.

The integration is built around a cryptographic link between the commit that triggers a build and the artifact it generates. As the build runs, attestations created on GitHub—including provenance and SBOM data—are pulled into JFrog Evidence and associated with the artifact. In the other direction, artifact lifecycle information, such as promotions to production, is pushed back to GitHub through the new artifact metadata API. This two-way flow lets you filter Dependabot alerts by production context and enforce policy-based gates at publish time.

How the workflow fits together

At a high level, the flow is straightforward:

  1. Push code to GitHub.
  2. Build and test with GitHub Actions.
  3. Link commits, builds, and artifacts for full lifecycle visibility.
  4. Publish artifacts to Artifactory automatically.
  5. Scan code with GitHub Advanced Security and artifacts with JFrog Xray.

The key benefit is that these steps no longer feel stitched together. Publishing and promoting an artifact is just another step in your GitHub Actions workflow, and the security scans on both sides of the supply chain run in context rather than as separate siloed processes.

Three capabilities stand out:

  • Unified security scans: Dependabot alerts are prioritized using production context from JFrog.
  • Policy-based promotion: Artifacts move between environments only when they pass the gates you configure.
  • Automatic evidence capture: All GitHub attestations (provenance, SBOM, custom attestations) are ingested into JFrog Evidence and tied to the build artifact.

Getting started

Setting up the integration takes a few steps in JFrog Artifactory and your GitHub Actions workflow.

  1. In Artifactory, navigate to Administration → General Management → Manage Integrations → GitHub. Toggle "Enable GitHub Actions" and authenticate your GitHub organization. Select your token type and create a pull request.

2. Trigger a build of your GitHub Actions workflow. The workflow must use both the jfrog/jfrog-setup-cli action and the actions/attest-build-provenance action to generate the attestation.

A minimal workflow that produces an attestation and pushes it to Artifactory might look like this:

3. After the build completes, the artifact lands in the JFrog Artifactory staging repository with its attestation, ready for validation.

4. JFrog verifies that the GitHub-signed provenance matches your trusted conditions—issuer, repository, workflow, branch. When the policy passes, the artifact is automatically promoted from the dev environment to production.

5. Once artifacts reach production, Dependabot keeps scanning the source repository. If a critical CVE turns up, administrators receive an alert.

6. Filter alerts and vulnerabilities for production artifacts with the tag artifact-registry:jfrog-artifactory. This filter works because JFrog automatically notifies GitHub when an artifact is promoted, so the artifact is picked up by Dependabot.

7. Remediate an alert by accepting the suggested dependency update, then rebuild and redeploy with fresh provenance.

To get the most out of the GitHub–JFrog connection, keep a few guidelines in mind:

  • Use OIDC to avoid long-lived credentials in your workflows.
  • Automate promotions in Artifactory to move artifacts from dev → staging → production.
  • Set security gates early so unattested or vulnerable builds never reach production.
  • Leverage provenance attestations in JFrog Evidence for instant traceability.

The GitHub and JFrog integration is available today. For detailed configuration steps, refer to the JFrog integration guide and the GitHub documentation on prioritizing Dependabot alerts.