Migrate the plugin source to consume Jfrog SDK instead of Jfrog CLI

Author: Ompragash

README.md

@@ -1,4 +1,4 @@
-A plugin to upload files to Jfrog artifactory.
+A plugin to upload files to Jfrog Artifactory. Now implemented using the JFrog Go Client SDK (no JFrog CLI dependency at runtime).
 
 Run the following script to install git-leaks support to this repo.
 ```
@@ -56,12 +56,19 @@ docker run --rm \
                       build_number: <+pipeline.executionId>
                       target_props: key1=value1,key2=value2
 ```
+Notes:
+- JFrog CLI is no longer required; the plugin uses `github.com/jfrog/jfrog-client-go` and `github.com/jfrog/build-info-go` under the hood.
+- Custom CA certificates can still be provided via `PLUGIN_PEM_FILE_CONTENTS` / `PLUGIN_PEM_FILE_PATH`; insecure TLS can be enabled via `PLUGIN_INSECURE=true`.
+
 ### Maven Build and Publish reference
 [Go to Maven reference](./docs/MAVEN_README.md)
 
 ### Gradle Build and Publish reference
 [Go to Gradle reference](./docs/GRADLE_README.md)
 
+### Multi-Step Build-Info Flow
+[End-to-end example: Upload → Add Deps → Download → Publish → Cleanup](./docs/BUILD_INFO_FLOW.md)
+
 ## Community and Support
 [Harness Community Slack](https://join.slack.com/t/harnesscommunity/shared_invite/zt-y4hdqh7p-RVuEQyIl5Hcx4Ck8VCvzBw) - Join the #drone slack channel to connect with our engineers and other users running Drone CI.
 

docker/Dockerfile.linux.amd64

@@ -28,11 +28,6 @@ RUN curl -fsSL https://services.gradle.org/distributions/gradle-${GRADLE_VERSION
     && rm /tmp/gradle.zip \
     && ln -s /opt/gradle/gradle-${GRADLE_VERSION}/bin/gradle /usr/local/bin/gradle
 
-# Install JFrog CLI
-RUN curl -fL https://getcli.jfrog.io/v2-jf | sh /dev/stdin 2.73.2
-RUN mv ./jf /usr/local/bin/jf
-RUN chmod +x /usr/local/bin/jf
-
 # Add your custom plugin
 ADD release/linux/amd64/plugin /bin/
 

docker/Dockerfile.linux.arm64

@@ -28,10 +28,5 @@ RUN curl -fsSL https://services.gradle.org/distributions/gradle-${GRADLE_VERSION
     && rm /tmp/gradle.zip \
     && ln -s /opt/gradle/gradle-${GRADLE_VERSION}/bin/gradle /usr/local/bin/gradle
 
-# Install JFrog CLI
-RUN curl -fL https://getcli.jfrog.io/v2-jf | sh /dev/stdin 2.73.2
-RUN mv ./jf /usr/local/bin/jf
-RUN chmod +x /usr/local/bin/jf
-
 ADD release/linux/arm64/plugin /bin/
 ENTRYPOINT ["/bin/plugin"]

docker/Dockerfile.windows.amd64.1809

@@ -23,9 +23,7 @@ COPY docker/cert.windows.pem docker/cacert.pem C:\users\ContainerAdministrator\.
 # Generate CA certificates and download/install tools in a single layer
 RUN certutil -generateSSTFromWU C:\certificates\ca-certificates.sst; `
     `
-    # Download JFrog CLI
-    Invoke-WebRequest -Uri https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.68.0/jfrog-cli-windows-amd64/jfrog.exe -OutFile C:\bin\jfrog.exe; `
-    `
+    
     # Download and install JDK
     Invoke-WebRequest -Uri "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8%2B7/OpenJDK17U-jdk_x64_windows_hotspot_17.0.8_7.zip" -OutFile "C:\jdk.zip"; `
     Expand-Archive -Path "C:\jdk.zip" -DestinationPath "C:\jdk"; `
@@ -48,7 +46,7 @@ RUN mkdir C:\bin C:\certificates C:\temp C:\uploads C:\jdk C:\maven C:\gradle
 # Copy certificates, JFrog CLI, JDK, Maven, and Gradle from builder stage
 COPY --from=builder C:\certificates C:\certificates
 COPY --from=builder C:\users\ContainerAdministrator\.jfrog C:\users\ContainerAdministrator\.jfrog
-COPY --from=builder C:\bin\jfrog.exe C:\bin\jfrog.exe
+
 COPY --from=builder C:\jdk C:\jdk
 COPY --from=builder C:\maven C:\maven
 COPY --from=builder C:\gradle C:\gradle

docker/Dockerfile.windows.amd64.ltsc2022

@@ -23,9 +23,7 @@ COPY docker/cert.windows.pem docker/cacert.pem C:\users\ContainerAdministrator\.
 # Generate CA certificates and download/install tools in a single layer
 RUN certutil -generateSSTFromWU C:\certificates\ca-certificates.sst; `
     `
-    # Download JFrog CLI
-    Invoke-WebRequest -Uri https://releases.jfrog.io/artifactory/jfrog-cli/v2/2.68.0/jfrog-cli-windows-amd64/jfrog.exe -OutFile C:\bin\jfrog.exe; `
-    `
+    
     # Download and install JDK
     Invoke-WebRequest -Uri "https://github.com/adoptium/temurin17-binaries/releases/download/jdk-17.0.8%2B7/OpenJDK17U-jdk_x64_windows_hotspot_17.0.8_7.zip" -OutFile "C:\jdk.zip"; `
     Expand-Archive -Path "C:\jdk.zip" -DestinationPath "C:\jdk"; `
@@ -48,7 +46,7 @@ RUN mkdir C:\bin C:\certificates C:\temp C:\uploads C:\jdk C:\maven C:\gradle
 # Copy certificates, JFrog CLI, JDK, Maven, and Gradle from builder stage
 COPY --from=builder C:\certificates C:\certificates
 COPY --from=builder C:\users\ContainerAdministrator\.jfrog C:\users\ContainerAdministrator\.jfrog
-COPY --from=builder C:\bin\jfrog.exe C:\bin\jfrog.exe
+
 COPY --from=builder C:\jdk C:\jdk
 COPY --from=builder C:\maven C:\maven
 COPY --from=builder C:\gradle C:\gradle
@@ -65,4 +63,4 @@ ENV CI="true"
 # Add plugin executable
 COPY release/windows/amd64/plugin C:/bin/drone-artifactory.exe
 
-ENTRYPOINT [ "C:\\bin\\drone-artifactory.exe" ]
+ENTRYPOINT [ "C:\\bin\\drone-artifactory.exe" ]

docs/ADD_BUILD_DEPENDENCIES_README.md

@@ -1,4 +1,4 @@
-A plugin to upload files to Jfrog artifactory.
+A plugin to upload files to JFrog Artifactory.
 
 Run the following script to install git-leaks support to this repo.
 ```
@@ -23,6 +23,10 @@ docker build -t plugins/artifactory  -f docker/Dockerfile .
 #  Adds dependencies from the local file-system to the build info
 This step is used to add dependencies from the local file-system to the build info.
 The dependencies are added to the build info in the Artifactory server. 
+Notes:
+- No JFrog CLI required. The plugin uses the JFrog Go Client SDK.
+- Dependencies are saved locally as build-info partials. Use `publish-build-info` or set `publish_build_info: true` to publish aggregated build-info.
+- To collect from Artifactory instead of filesystem, set `from_rt: true` and provide a `dependency` pattern or a `spec_path`.
 
 ###  Add dependencies with a dependency pattern:
 ```yaml

docs/BUILD_INFO_FLOW.md

@@ -0,0 +1,119 @@
+Multi-Step Build Info Pipeline (Upload → Add Deps → Download → Publish → Cleanup)
+
+Overview
+- No JFrog CLI required; the plugin uses the JFrog Go Client SDK.
+- Upload, Download, and Add-Build-Dependencies steps save build-info partials locally using build-info-go.
+- Publish step aggregates and publishes the full build-info to Artifactory.
+- Optional auto-clean and explicit cleanup supported.
+
+Example (Harness CI Plugin steps)
+
+```yaml
+# 1) Upload artifacts and accumulate build-info (partials)
+- step:
+    type: Plugin
+    name: UploadArtifacts
+    identifier: UploadArtifacts
+    spec:
+      connectorRef: account.harnessImage
+      image: plugins/artifactory:linux-amd64
+      settings:
+        url: https://URL.jfrog.io/artifactory
+        username: user
+        password: <+secrets.getValue("jfrog_password")>
+        # Either use source/target or a file spec
+        source: /harness/build/output/**/*.jar
+        target: libs-release-local/path/in/repo/
+        build_name: sample-build
+        build_number: 123
+        # Optional: properties on target
+        target_props: key1=value1,key2=value2
+        # Do not publish yet (accumulate partials)
+        publish_build_info: false
+
+# 2) Add build dependencies (from filesystem). Also accumulates partials
+- step:
+    type: Plugin
+    name: AddBuildDependencies
+    identifier: AddBuildDependencies
+    spec:
+      connectorRef: account.harnessImage
+      image: plugins/artifactory:linux-amd64
+      settings:
+        command: add-build-dependencies
+        url: https://URL.jfrog.io
+        username: user
+        password: <+secrets.getValue("jfrog_password")>
+        build_name: sample-build
+        build_number: 123
+        module: generic-module
+        # Collect dependencies from local filesystem
+        dependency: /harness/inputs/**/*.zip
+        # Or collect from Artifactory:
+        # from_rt: true
+        # dependency: libs-release-local/**/*.jar
+
+# 3) Download artifacts (records dependencies into build-info partials)
+- step:
+    type: Plugin
+    name: DownloadArtifacts
+    identifier: DownloadArtifacts
+    spec:
+      connectorRef: account.harnessImage
+      image: plugins/artifactory:linux-amd64
+      settings:
+        command: download
+        url: https://URL.jfrog.io/artifactory
+        username: user
+        password: <+secrets.getValue("jfrog_password")>
+        build_name: sample-build
+        build_number: 123
+        module: generic-module
+        # Use a file spec (recommended)
+        spec: |
+          {
+            "files": [
+              { "pattern": "libs-release-local/com/example/**/artifact-*.jar",
+                "target": "./downloads/",
+                "recursive": "true",
+                "flat": "false"
+              }
+            ]
+          }
+
+# 4) Publish build-info (aggregates all partials). Optionally auto-clean afterwards
+- step:
+    type: Plugin
+    name: PublishBuildInfo
+    identifier: PublishBuildInfo
+    spec:
+      connectorRef: account.harnessImage
+      image: plugins/artifactory:linux-amd64
+      settings:
+        command: publish-build-info
+        url: https://URL.jfrog.io
+        username: user
+        password: <+secrets.getValue("jfrog_password")>
+        build_name: sample-build
+        build_number: 123
+        cleanup_after_publish: true
+
+# 5) (Optional) Explicit cleanup step (only needed if not using cleanup_after_publish)
+- step:
+    type: Plugin
+    name: CleanBuildInfo
+    identifier: CleanBuildInfo
+    spec:
+      connectorRef: account.harnessImage
+      image: plugins/artifactory:linux-amd64
+      settings:
+        command: cleanup
+        build_name: sample-build
+        build_number: 123
+```
+
+Notes
+- TLS: Provide custom CA PEM via `pem_file_contents` or `pem_file_path`. To skip verification, set `insecure: true`.
+- Access token: You can use `access_token` in place of `username`/`password`.
+- If you prefer to publish after each operation, set `publish_build_info: true` on those steps (and optionally `cleanup_after_publish: true`).
+

docs/DOWNLOAD_README.md

@@ -1,4 +1,4 @@
-A plugin to download files from Jfrog artifactory.
+A plugin to download files from JFrog Artifactory.
 
 Run the following script to install git-leaks support to this repo.
 ```
@@ -20,10 +20,14 @@ Build the plugin image:
 docker build -t plugins/artifactory  -f docker/Dockerfile .
 ```
 
-#  Download artifact to Jfrog Artifactory
+#  Download artifact to JFrog Artifactory
 This step downloads the artifacts from Jfrog Artifactory.
 A valid spec or a spec path given as an argument is mandatory.
 The spec json format should be the same as Jfrog spec format
+Notes:
+- No JFrog CLI required. The plugin uses the JFrog Go Client SDK.
+- Build-info dependencies from downloads are saved locally and can be published later using `publish-build-info` or by setting `publish_build_info: true` in this step.
+- TLS: Provide custom CA PEM via `pem_file_contents`/`pem_file_path`, or set `insecure: true` to skip verification.
 
 ### Download artifact to Jfrog Artifactory using spec path example:
 ```yaml

docs/GRADLE_README.md

@@ -1,4 +1,4 @@
-A plugin to upload files to Jfrog artifactory.
+A plugin to upload files to Jfrog Artifactory.
 
 Run the following script to install git-leaks support to this repo.
 ```
@@ -24,6 +24,10 @@ docker build -t plugins/artifactory  -f docker/Dockerfile .
 - Gradle build step is used to build the Gradle project and create artifacts.
 - Publish step is used to publish the Gradle project artifacts to the artifactory repositories.
 - Authentication for Jfrog artifactory can be done using Username and Password or Access Token. Refer to below examples.
+- This plugin no longer requires JFrog CLI. It uses the JFrog Go Client SDK. For Gradle, the plugin generates a temporary `init.gradle` that injects resolver and (if applicable) publishing repositories and credentials, then invokes `gradle` natively.
+- Build-info is accumulated locally and can be published using `publish-build-info` command or `publish_build_info: true`.
+- Module IDs: When `build_tool: gradle` and no `module` is provided, the plugin derives the module ID from Gradle project properties (`group:name:version`) similar to JFrog CLI extractors. If Gradle is not available or values are missing, the module defaults to `generic`. To override, set the `module` input.
+- TLS: Provide custom CA PEM contents via `pem_file_contents` or a path via `pem_file_path`. To skip TLS verification, set `insecure: true`.
 - Additional build discard with below parameters can be done.
     - delete_artifacts: The flag to delete the artifacts, if not set will only delete build metadata.
     - exclude_builds: The builds to exclude from deletion.
@@ -87,6 +91,10 @@ The config is same as the "Gradle Publish step example using Username and Passwo
 "password" should be set as the access token value, access token will be a very long string
 
 
+## Notes on Build-Info Behavior
+- Upload, download, and add-build-dependencies save build-info partials locally. Use `publish-build-info` to aggregate and publish, or set `publish_build_info: true` to publish in the same step.
+- Use `command: cleanup` with `build_name` and `build_number` to remove local cached build-info for that build.
+
 ### Gradle Publish step with build discard additional parameters
 ```yaml
 - step:

docs/MAVEN_README.md

@@ -1,4 +1,4 @@
-A plugin to upload files to Jfrog artifactory.
+A plugin to upload files to Jfrog Artifactory.
 
 Run the following script to install git-leaks support to this repo.
 ```
@@ -21,9 +21,14 @@ docker build -t plugins/artifactory  -f docker/Dockerfile .
 ```
 
 # Maven Build and Publish
+- This plugin no longer requires JFrog CLI. It uses the JFrog Go Client SDK under the hood.
+- For Maven, the plugin generates a temporary `settings.xml` with resolver and deploy repositories and credentials based on the provided inputs, and then invokes `mvn` natively.
+- Build-info is accumulated locally across steps and can be published using the `publish-build-info` command or by setting `publish_build_info: true`.
+- Module IDs: When `build_tool: mvn` and no `module` is provided, the plugin derives the module ID from the POM as `groupId:artifactId:version` (similar to JFrog CLI extractors). To override, set the `module` input.
 - Maven build step is used to build the maven project and create artifacts. 
 - Publish step is used to publish the maven project artifacts to the artifactory repositories.
 - Authentication for Jfrog artifactory can be done using Username and Password or Access Token. Refer to below examples.
+- TLS: Provide custom CA PEM contents via `pem_file_contents` or a path via `pem_file_path`. To skip TLS verification, set `insecure: true`.
 - Additional build discard with below parameters can be done.
     - delete_artifacts: The flag to delete the artifacts, if not set will only delete build metadata.
     - exclude_builds: The builds to exclude from deletion.
@@ -126,6 +131,11 @@ docker build -t plugins/artifactory  -f docker/Dockerfile .
 
 
 
+## Notes on Build-Info Behavior
+- Upload, download, and add-build-dependencies commands save build-info partials locally. Use `publish-build-info` to aggregate and publish, or set `publish_build_info: true` in the step to publish after the operation.
+- Use `command: cleanup` with `build_name` and `build_number` to remove local cached build-info for that build.
+
+
 ## Community and Support
 [Harness Community Slack](https://join.slack.com/t/harnesscommunity/shared_invite/zt-y4hdqh7p-RVuEQyIl5Hcx4Ck8VCvzBw) - Join the #drone slack channel to connect with our engineers and other users running Drone CI.