From 5537cba1079b3048dd3b8b7b7a9a43ddb1c586b3 Mon Sep 17 00:00:00 2001 From: Dipo Ajayi Date: Tue, 20 Oct 2026 14:47:06 +0100 Subject: [PATCH] ci: bump the shared build workflow to main and use a scoped JFrog identity This repo pinned an old ref that predates artifactory_oidc_provider_name, so it could not select a scoped identity and kept authenticating as the org-wide account -- which holds MANAGE across an entire artifact tier. Bumping to @main is interface-safe: no new required inputs and nothing removed between the pinned ref and main. Also drops artifactory_username/password, which are declared but ignored on main (auth is OIDC-only). Co-Authored-By: Claude Code --- .github/workflows/release-to-jfrog.yaml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-to-jfrog.yaml b/.github/workflows/release-to-jfrog.yaml index b4fe10e..5331450 100644 --- a/.github/workflows/release-to-jfrog.yaml +++ b/.github/workflows/release-to-jfrog.yaml @@ -12,13 +12,11 @@ permissions: jobs: build: name: Build - uses: truefoundry/github-workflows-public/.github/workflows/build.yml@v0.1.5 + uses: truefoundry/github-workflows-public/.github/workflows/build.yml@main with: image_tag: ${{ github.sha }} image_artifact_name: async_processor artifactory_registry_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_REGISTRY_URL }} artifactory_repository_url: ${{ vars.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_REPOSITORY }} image_scan_severity_cutoff: critical - secrets: - artifactory_username: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_USERNAME }} - artifactory_password: ${{ secrets.TRUEFOUNDRY_ARTIFACTORY_PUBLIC_PASSWORD }} + artifactory_oidc_provider_name: github-jfrog-public