Why does automatic evidence collection require OIDC authentication?

How can we help?

We have multiple workflows that utilize this action to enable jfrog-cli usage within github actions. When analyzing the Post Setup JFrog Cli output, I noticed this line in the evidence collection section:

Evidence collection does not support authentication with username and password. Skipping evidence collection.

In our configuration, we are unable to easily and and manage these OIDC providers as described in the "Connecting to JFrog using OIDC (OpenID Connect)" section of the README in this repo, and thus can only use username/password authentication.

The question is, why is this the case? Are there any plans in the works to fix this and thus enable support for automatic evidence upload no matter what the authentication method is?

Thank you!

Start with the README's “Connecting to JFrog using OIDC (OpenID Connect)” section and the Post Setup JFrog Cli output described in the issue. Trace how evidence collection handles username/password authentication, then establish whether broader authentication support is technically and operationally in scope. Done would mean a documented explanation and a clear plan or decision about support for automatic evidence upload with non-OIDC authentication.