From 77ff2d77b6c363c9be24d112f4f5a96c3244b722 Mon Sep 17 00:00:00 2001 From: Dipo Ajayi Date: Tue, 20 Oct 2026 13:50:17 +0100 Subject: [PATCH 1/2] ci: use the scoped JFrog OIDC integration Passes artifactory_oidc_provider_name so this repository authenticates to JFrog as a least-privilege account scoped to the artifacts it publishes, rather than the shared org-wide identity that holds MANAGE across an entire artifact tier. Requires truefoundry/github-workflows-public#31 (adds the input). No-op until that merges. Co-Authored-By: Claude Code --- .github/workflows/push-sandbox-image.yml | 1 + .github/workflows/release.yml | 2 ++ 2 files changed, 3 insertions(+) diff --git a/.github/workflows/push-sandbox-image.yml b/.github/workflows/push-sandbox-image.yml index 1a5e3e72c..231581fd3 100644 --- a/.github/workflows/push-sandbox-image.yml +++ b/.github/workflows/push-sandbox-image.yml @@ -23,6 +23,7 @@ jobs: id-token: write contents: read with: + artifactory_oidc_provider_name: github-jfrog-trueforge artifactory_registry_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_REGISTRY_URL }} artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY }} image_artifact_name: trueforge-sandbox diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 8736bf4b0..a6d9ff9e1 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -418,6 +418,7 @@ jobs: id-token: write contents: read with: + artifactory_oidc_provider_name: github-jfrog-trueforge # The shared build.yml inherits THIS run's github.sha, which is the # pre-version dispatch commit. version-release has already pushed the # bumped tree, so name it explicitly or the image ships the old @@ -449,6 +450,7 @@ jobs: id-token: write contents: read with: + artifactory_oidc_provider_name: github-jfrog-trueforge-private # Same reason as the public image: build the version commit, not the # dispatch commit. checkout_ref: ${{ needs.version-release.outputs.sha }} From 4d697666ee32c7337155305d22992d702826443b Mon Sep 17 00:00:00 2001 From: Dipo Ajayi Date: Tue, 20 Oct 2026 14:11:15 +0100 Subject: [PATCH 2/2] ci: stop passing the deprecated JFrog username/password secrets artifactory_username and artifactory_password are declared on the shared workflows but ignored -- JFrog auth there is OIDC-only. Passing them implies a credential path that no longer exists. Removing them from callers is a prerequisite for dropping the declarations from the shared workflows, which cannot happen while callers still pass them: reusable workflows validate secrets strictly, so an undeclared secret fails the run. Co-Authored-By: Claude Code --- .github/workflows/push-sandbox-image.yml | 3 --- .github/workflows/release.yml | 5 ----- 2 files changed, 8 deletions(-) diff --git a/.github/workflows/push-sandbox-image.yml b/.github/workflows/push-sandbox-image.yml index 231581fd3..b1ec562d0 100644 --- a/.github/workflows/push-sandbox-image.yml +++ b/.github/workflows/push-sandbox-image.yml @@ -34,9 +34,6 @@ jobs: platforms: linux/amd64 enable_jfrog: true enable_public_ecr: false - secrets: - artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }} - artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }} print-uri: name: Print pushed image URI diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index a6d9ff9e1..5773f2f2c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -433,9 +433,6 @@ jobs: platforms: linux/amd64 enable_jfrog: true enable_public_ecr: false - secrets: - artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }} - artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }} build-image-private: name: Build and push hardened server image @@ -472,8 +469,6 @@ jobs: RUNTIME_BASE_IMAGE=526077812922.dkr.ecr.us-east-1.amazonaws.com/tfy-internal/node:24 VITE_POSTHOG_HOST=https://eu.i.posthog.com/ secrets: - artifactory_username: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_USERNAME }} - artifactory_password: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_PASSWORD }} private_ecr_pull_role_arn: ${{ secrets.AWS_DEVTEST_ECR_IAM_ROLE_ARN }} # Caller with: has no secrets context; pass secret build-args here so the # shared workflow can append them to image_build_args.