improvements and security fixes

[bhanurp]

• This pull request is created in the jfrog/jenkins-jfrog-plugin repository.
• Unified frogbot flow
• Added audit workflow
• Migrated to JDK17
• Fixed multiple security issues

[github-actions]

📗 Scan Summary

• Frogbot scanned for vulnerabilities and found 1 issues

Scan Category	Status	Security Issues
Software Composition Analysis	✅ Done	Not Found
Contextual Analysis	✅ Done	-
Static Application Security Testing (SAST)	✅ Done	1 Issues Found 1 Low
Secrets	✅ Done	-
Infrastructure as Code (IaC)	✅ Done	Not Found

---

🐸 JFrog Frogbot

[github-actions]

🎯 Static Application Security Testing (SAST) Vulnerability

Severity	Finding
Low	Detected usage of communication methods lacking encryption.

Full description

Vulnerability Details

Rule ID:	java-insecure-protocol

Overview

Using insecure protocols—such as HTTP, FTP, or LDAP—can expose sensitive
data during transmission, making it vulnerable to eavesdropping and man-in-the-middle
attacks. Secure protocols like HTTPS and FTPS should be used to ensure data
encryption during communication.

Vulnerable example

In this example, the application uses insecure protocols to communicate,
taking the protocol type from hardcoded strings.

import java.io.IOException;
import java.net.URL;
import java.net.URLConnection;

public class insecure_protocol_vuln {

    public void connectToFrogService(String server) throws IOException {
        String insecureHttpProtocol = "http://"; // Insecure protocol
        String url = insecureHttpProtocol + server + "/frogEndpoint";
        URL obj = new URL(url);
        URLConnection conn = obj.openConnection(); // Vulnerable: Insecure protocol
        conn.connect();
    }
}

Remediation

To mitigate the use of insecure protocols, replace them with secure alternatives
such as HTTPS or FTPS.

import java.io.IOException;
import java.net.URL;
import java.net.URLConnection;
import javax.net.ssl.HttpsURLConnection;

public class insecure_protocol_safe {

    public void connectToFrogService(String server) throws IOException {
        String secureHttpProtocol = "https://"; // Secure protocol
        String url = secureHttpProtocol + server + "/frogEndpoint";
        URL obj = new URL(url);
        HttpsURLConnection conn = (HttpsURLConnection) obj.openConnection(); // Safe: Secure protocol
        conn.connect();
    }
}

<br></details>

---
<div align='center'>

[🐸 JFrog Frogbot](https://docs.jfrog-applications.jfrog.io/jfrog-applications/frogbot)

</div>

[agrasth]

Here I can see we are checking for safe to test before pr audit, but seems like remove label step is not added.

[bhanurp]

Here I can see we are checking for safe to test before pr audit, but seems like remove label step is not added.

github actions removeLabel workflow is available here https://github.com/jfrog/jenkins-jfrog-plugin/actions/workflows/remove-label.yml