ci: use the scoped JFrog OIDC integration

[DeeAjayi]

TrueForge gets its own dedicated JFrog integrations rather than sharing the org-wide tier accounts. The hardened image goes to a different Artifactory repo than the public one, so it gets a separate integration.

File	Job	Pushes to	Integration
push-sandbox-image.yml	build	TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY	github-jfrog-trueforge
release.yml	build-image-public	TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY	github-jfrog-trueforge
release.yml	build-image-private	TRUEFOUNDRY_ARTIFACTORY_PRIVATE_REPOSITORY	github-jfrog-trueforge-private

Not changed

release-chart.yml publishes the Helm chart with static Artifactory credentials rather than OIDC. Moving that is a separate migration.

No other inputs, secrets, or steps are touched — including build-image-private's ECR pull-through config.

Ready to merge

The shared-workflow dependency has landed — truefoundry/workflows#49 and github-workflows-public#31 are both merged, so artifactory_oidc_provider_name exists on main. (An earlier version of this description said to wait; that is no longer accurate.)

Access is additionally gated by a per-repository allowlist in ubermold-truefoundry#2314 (jfrog/oidc.tf), which is not yet merged. Until it is, this repo is not on the allowlist and the push will fail authorization.

So: merge #2314 first, then this. Merging this alone breaks publishing for this repo.

After merging

Confirm the next build actually pushed. A wrong integration fails at push time, not at plan time.

🤖 Generated with Claude Code

---

Note

Medium Risk
Release and sandbox image publishing now depend on OIDC provider configuration and repo allowlisting; misconfiguration fails at push time and blocks publishing until infra is aligned.

Overview
Docker image publish jobs in push-sandbox-image.yml and release.yml now authenticate to JFrog Artifactory via GitHub OIDC instead of long-lived username/password secrets.

Each reusable build.yml call passes artifactory_oidc_provider_name: github-jfrog-trueforge for the sandbox image and public server image (public Artifactory repo), and github-jfrog-trueforge-private for the hardened server image (private repo). The corresponding artifactory_username / artifactory_password secrets blocks are removed from those jobs; build-image-private still passes ECR pull and PostHog build secrets unchanged.

Helm chart publishing (release-chart.yml) is not part of this change and still uses static Artifactory credentials.

^{Reviewed by Cursor Bugbot for commit 4d69766. Bugbot is set up for automated code reviews on this repo. Configure here.}

---

Also in this PR: dropping the deprecated secrets

artifactory_username / artifactory_password are declared on the shared workflows but ignored — auth there is OIDC-only. This stops passing them.

Safe on its own: the shared workflows still declare them as optional, so removing them from the caller changes nothing at runtime. It is a prerequisite for removing the declarations later, which cannot happen while any caller still passes them.

Static-credential steps in this repo (direct docker login, helm push) are untouched — those use real credentials and are a separate migration.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 4d69766

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR