How to Use JFrog CLI Without Editing Your CI Scripts

The payoff: Every existing npm install or mvn package line in your pipeline starts flowing through JFrog CLI, capturing build-info and routing traffic through Artifactory, without touching a single CI script.

The Framework

The technique is a single setup parameter: package_alias=true. Set it once when JFrog CLI is installed in the pipeline, and the CLI intercepts native package manager commands and handles them itself — no jf prefix required in front of every command. Instead of rewriting npm install to jf npm install across every job, workflow, and repo, the alias does the rewriting invisibly at the CLI layer.

Step 1: Enable package_alias at Install Time

In a GitHub Actions workflow, this is set on the setup-jfrog-cli action itself:

- name: Set up the JFrog CLI (Frictionless CLI on)
  uses: jfrog/setup-jfrog-cli@v4
  with:
    package_alias: true
  env:
    JF_URL: ${{ secrets.JFROG_URL }}
    JF_ACCESS_TOKEN: ${{ secrets.JFROG_ACCESS_TOKEN }}

JF_URL points at your Artifactory instance; JF_ACCESS_TOKEN authenticates the CLI. Both are read once at setup and persist for the rest of the job.

Step 2: Leave the Rest of the Pipeline Untouched

This is the entire point of the technique. With the alias active, existing steps like npm install or mvn package keep running exactly as written — no jf prefix, no wrapper script, no conditional logic per job. JFrog CLI sits between the shell and the package manager and handles the routing itself.

Step 3: Get Build-Info and Upload Behavior for Free

Once commands are routed through the CLI, three things happen automatically, according to JFrog’s writeup:

• Build-info generation — dependency metadata, machine information, and CI process details get captured for security scanning without any extra step.
• Parallel chunked uploads — large artifacts are split and transferred concurrently rather than as a single blocking upload.
• Persistent authentication — one login covers every repository operation in the job, rather than re-authenticating per package manager call.

The CLI covers 20+ package manager types, so this isn’t limited to npm and Maven — the same package_alias setup applies across the supported list.

Where It Doesn’t Apply

package_alias relies on intercepting commands resolved through the system PATH. Native wrapper tools like mvnw and gradlew don’t work this way — they point at absolute binary paths rather than resolving through PATH — so the alias interception doesn’t apply to them, per JFrog’s documentation. Pipelines that lean on mvnw/gradlew wrappers will need a different setup for those specific commands even with package_alias enabled elsewhere in the job.

Source: JFrog Blog

Content created with AI assistance and reviewed for accuracy.