build-publish-mcr.yaml

# This Github Action will build and publish images to Azure Container Registry(ACR), from where the published images will be
# automatically pushed to the trusted registry, Microsoft Container Registry(MCR).
name: Building and Pushing to MCR
on:
  release:
    types: [published]

permissions:
  id-token: write # This is required for requesting the JWT
  contents: write # release changes require contents write

env:
  REGISTRY_REPO: unlisted/aks/eno

jobs:
  prepare-variables:
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ github.event.release.tag_name }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: 'Set output variables'
        id: vars
        run: |
          # set the image version
          RELEASE_TAG=${{ inputs.releaseTag }}
          if [ -z "$RELEASE_TAG" ]; then
            RELEASE_TAG=`git describe --tags $(git rev-list --tags --max-count=1)`
            echo "The user input release tag is empty, will use the latest tag $RELEASE_TAG."
          fi
          echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT

          # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
          # from AZURE_REGISTRY secret is not exported from here.

  publish-manifest:
    runs-on: ubuntu-latest
    needs: prepare-variables
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare-variables.outputs.release_tag }}
      - name: Build and push deployment manifest
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        run: |
          cat ./api/v1/config/crd/* > manifest.yaml
          cat ./dev/deploy.yaml | REGISTRY="mcr.microsoft.com/aks/eno" TAG="${{ needs.prepare-variables.outputs.release_tag }}" envsubst >> manifest.yaml
          gh release upload ${{ needs.prepare-variables.outputs.release_tag }} manifest.yaml

  publish-images:
    runs-on:
      labels: [self-hosted, "1ES.Pool=1es-aks-eno-pool-ubuntu"]
    needs: prepare-variables
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare-variables.outputs.release_tag }}
      - name: 'Login the ACR'
        run: |
          az login --identity
          az acr login -n ${{ secrets.AZURE_REGISTRY }}
      - name: Build and publish eno-controller
        run: |
          make docker-build-eno-controller
        env:
          ENO_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
      - name: Build and publish eno-reconciler
        run: |
          make docker-build-eno-reconciler
        env:
          ENO_RECONCILER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}