Skip to content

ci: use the scoped JFrog OIDC integration #1103

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
ramantehlan merged 3 commits into from
Oct 21, 2026
Merged

ci: use the scoped JFrog OIDC integration #1103

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
77ff2d7
ci: use the scoped JFrog OIDC integration
DeeAjayi Oct 20, 2026
4d69766
ci: stop passing the deprecated JFrog username/password secrets
DeeAjayi Oct 20, 2026
4bb4d5b
Merge branch 'main' into oladipupo/jfrog-oidc-scoped-integration
ramantehlan Oct 21, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 1 addition & 3 deletions .github/workflows/push-sandbox-image.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -23,6 +23,7 @@ jobs:
id-token: write
contents: read
with:
artifactory_oidc_provider_name: github-jfrog-trueforge
artifactory_registry_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_REGISTRY_URL }}
artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY }}
image_artifact_name: trueforge-sandbox
Expand All @@ -33,9 +34,6 @@ jobs:
platforms: linux/amd64
enable_jfrog: true
enable_public_ecr: false
secrets:
artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }}
artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }}

print-uri:
name: Print pushed image URI
Expand Down
7 changes: 2 additions & 5 deletions .github/workflows/release.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -418,6 +418,7 @@ jobs:
id-token: write
contents: read
with:
artifactory_oidc_provider_name: github-jfrog-trueforge
# The shared build.yml inherits THIS run's github.sha, which is the
# pre-version dispatch commit. version-release has already pushed the
# bumped tree, so name it explicitly or the image ships the old
Expand All @@ -432,9 +433,6 @@ jobs:
platforms: linux/amd64
enable_jfrog: true
enable_public_ecr: false
secrets:
artifactory_username: ${{ secrets.TRUEFORGE_ARTIFACTORY_USERNAME }}
artifactory_password: ${{ secrets.TRUEFORGE_ARTIFACTORY_PASSWORD }}

build-image-private:
name: Build and push hardened server image
Expand All @@ -449,6 +447,7 @@ jobs:
id-token: write
contents: read
with:
artifactory_oidc_provider_name: github-jfrog-trueforge-private
# Same reason as the public image: build the version commit, not the
# dispatch commit.
checkout_ref: ${{ needs.version-release.outputs.sha }}
Expand All @@ -470,8 +469,6 @@ jobs:
RUNTIME_BASE_IMAGE=526077812922.dkr.ecr.us-east-1.amazonaws.com/tfy-internal/node:24
VITE_POSTHOG_HOST=https://eu.i.posthog.com/
secrets:
artifactory_username: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_USERNAME }}
artifactory_password: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PRIVATE_PASSWORD }}
private_ecr_pull_role_arn: ${{ secrets.AWS_DEVTEST_ECR_IAM_ROLE_ARN }}
# Caller with: has no secrets context; pass secret build-args here so the
# shared workflow can append them to image_build_args.
Expand Down
Loading