[DeeAjayi]

This repo pinned an old ref of the shared build workflow. That ref predates the artifactory_oidc_provider_name input — and in fact predates OIDC entirely: it authenticated to JFrog with a static username and password via docker/login-action, using org-wide credentials with no repository scoping at all.

Bumping to @main moves this repo onto the OIDC token exchange and lets it select a least-privilege identity.

Changes

• Bumps truefoundry/github-workflows-public/.github/workflows/build.yml from @v0.1.5 to @main
• Passes artifactory_oidc_provider_name: github-jfrog-public
• Drops artifactory_username / artifactory_password — declared but ignored on main, auth is OIDC-only

Is the bump safe?

Interface-checked: between @v0.1.5 and main there are no new required inputs, and no inputs or secrets removed. The shared workflow has only grown additively.

Behaviour may still differ — this skips several releases — so watch the first run.

Depends on

ubermold-truefoundry#2314 adds the allowlist this repo needs. Merge that first. Until then this repo is not on the github-jfrog-public allowlist and the push fails authorization.

After merging

Confirm the next build actually pushed. A wrong or missing allowlist entry fails at push time, not at plan time.

🤖 Generated with Claude Code

---

Note

Medium Risk
Changes how release images authenticate and publish to Artifactory; a misconfigured OIDC allowlist fails at push time and the @main workflow pin may behave differently than @v0.1.5.

Overview
Updates release-to-jfrog so JFrog pushes use the shared build workflow on @main instead of pinned @v0.1.5.

Authentication switches from username/password secrets to OIDC via artifactory_oidc_provider_name: github-jfrog-public, so the job can use a scoped JFrog identity rather than the org-wide Artifactory account. The workflow no longer passes artifactory_username / artifactory_password to the reusable job.

Note: The first run after merge should be watched; authorization depends on the github-jfrog-public allowlist (see related infra PR).

^{Reviewed by Cursor Bugbot for commit 5537cba. Bugbot is set up for automated code reviews on this repo. Configure here.}

[mitanshudodia]

Approved — workflow-only diff verified (scoped JFrog OIDC via github-jfrog-private, deprecated username/password secrets dropped). Title updated to include INFRA-1994. Do NOT merge until truefoundry/ubermold-truefoundry#2314 (per-repo OIDC allowlist) is merged and applied, otherwise publishing will fail at push time.