From c8659a153dc712c84f92e18974f6588c4ef31880 Mon Sep 17 00:00:00 2001 From: NirWolfer Date: Mon, 19 Oct 2026 16:12:17 +0300 Subject: [PATCH] ci: Use basic auth for jf in the Artifactory cleanup job jf config add with --user/--password enables token auto-refresh by default, so the first jf command calls POST api/security/token to mint a refreshable token. The IL instance rejects that call for the reference token in svc-nixl-il-artifactory-token ("This endpoint does not support reference tokens as the bearer credential"), so the cleanup job has failed since the IL move. Other jobs use the same credential through docker login and curl basic auth and are unaffected. --basic-auth-only skips the token exchange and sends the credential as basic auth, which the IL instance accepts. HPCINFRA-4972 Signed-off-by: NirWolfer --- .ci/docs/ci-overview.md | 2 +- .ci/scripts/artifactory-cleanup-by-time.sh | 2 ++ 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.ci/docs/ci-overview.md b/.ci/docs/ci-overview.md index 9a571197a9..267b491b01 100644 --- a/.ci/docs/ci-overview.md +++ b/.ci/docs/ci-overview.md @@ -222,7 +222,7 @@ anonymous clones with an HTTP 401, which git reports as `could not read Username ### `nixl-ci-cleanup-artifacts` (standalone) - **Trigger:** Daily cron at 6 AM, or manual run with optional `DRY_RUN=true` parameter. - **What it does:** Deletes stale Artifactory artifacts based on `.ci/cleanup-spec.json` — PR Docker images older than 1 day, CI base images not pulled in 2 weeks, verification Docker images and PyPI wheels older than 3 months. The same spec runs against il.artifactory.nvidia.com (CI images) and artifactory.nvidia.com (verification images and wheels, until they move to IL too). Images under `static/` (e.g. `static/infinia-libs`) are never deleted: the script skips that folder regardless of what the spec matches. -- **Matrix:** `.ci/jenkins/lib/cleanup-matrix.yaml`. Runs on an Ubuntu 24.04 container with `jf` and `jq` installed at runtime. +- **Matrix:** `.ci/jenkins/lib/cleanup-matrix.yaml`. Runs on an Ubuntu 24.04 container with `jf` and `jq` installed at runtime. `jf` is configured with `--basic-auth-only`: the IL credential is a reference token, and jf's default token auto-refresh (`api/security/token`) rejects reference tokens. - **Automatic on every PR:** No — standalone/scheduled + manual only. ### `nixl-ci-test-llm-container` (standalone) diff --git a/.ci/scripts/artifactory-cleanup-by-time.sh b/.ci/scripts/artifactory-cleanup-by-time.sh index 6a5f23ee7d..df666f8cf6 100755 --- a/.ci/scripts/artifactory-cleanup-by-time.sh +++ b/.ci/scripts/artifactory-cleanup-by-time.sh @@ -39,10 +39,12 @@ USER="${ARTIFACTORY_USER:?Set ARTIFACTORY_USER}" export JFROG_CLI_LOG_LEVEL=ERROR +# Skip jf's token exchange (api/security/token), which rejects reference tokens. jf config add artifactory \ --artifactory-url "${ARTIFACTORY_URL}" \ --password "${TOKEN}" \ --user "${USER}" \ + --basic-auth-only \ --interactive=false \ --overwrite