Swap to ghcr and clean up workflows

* Update checkout and docker login targets

Author: matthchr

.github/workflows/api-docs-repo.yaml

@@ -30,7 +30,7 @@ jobs:
           private-key: ${{ secrets.AUTOMATION_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           ref: main
 
@@ -42,36 +42,22 @@ jobs:
           branch: ${{ format('bot/update-api-docs-{0}', github.run_number) }}
 
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           ref: ${{ format('bot/update-api-docs-{0}', github.run_number) }}
           fetch-depth: 0 # required to access tags
           submodules: "true"
 
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned to v3.3.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # pinned to v3.7.0
         with:
-          registry: docker.pkg.github.com # ghcr.io not yet enabled for Azure org
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build devcontainer image
-        # We must issue a manual pull before the build so the image gets copied locally, because
-        # docker.pkg.github.com is not a valid Docker registry and doesn't work with --cache-from,
-        # however, `docker pull` will fall back to other methods that do work and get the image loaded.
-        #
-        # This message comes from "docker pull":
-        #
-        # Run docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-        # WARNING: ⚠️ Failed to pull manifest by the resolved digest. This registry does not
-        #  appear to conform to the distribution registry specification; falling back to
-        #  pull by tag.  This fallback is DEPRECATED, and will be removed in a future
-        #  release.  Please contact admins of https://docker.pkg.github.com. ⚠️
-        #
-        # See: https://github.com/moby/moby/issues/41687#issuecomment-733826074 and related issues
         run: |
-          docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-          docker build --cache-from docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
+          docker build --cache-from ghcr.io/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
         env:
           DOCKER_BUILDKIT: 1
 

.github/workflows/build-devcontainer-image.yml

@@ -29,12 +29,12 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
 
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned to v3.3.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # pinned to v3.7.0
         with:
-          registry: docker.pkg.github.com # ghcr.io not yet enabled for Azure org
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
@@ -46,5 +46,5 @@ jobs:
           # Embed inline cache metadata so consumers can use --cache-from
           cache-to: type=inline
           tags: |
-            docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-            docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:${{ github.sha }}
+            ghcr.io/azure/azure-service-operator/aso-devcontainer:latest
+            ghcr.io/azure/azure-service-operator/aso-devcontainer:${{ github.sha }}

.github/workflows/codeql.yml

@@ -46,7 +46,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
 
       # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/copilot-setup-steps.yml

@@ -20,7 +20,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: 'true'

.github/workflows/create-release-experimental.yml

@@ -23,7 +23,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: "true"

.github/workflows/create-release-official.yml

@@ -16,7 +16,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: "true"

.github/workflows/deploy-site.yml

@@ -35,35 +35,21 @@ jobs:
           private-key: ${{ secrets.AUTOMATION_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: "true"
 
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned to v3.3.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # pinned to v3.7.0
         with:
-          registry: docker.pkg.github.com # ghcr.io not yet enabled for Azure org
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build devcontainer image
-        # We must issue a manual pull before the build so the image gets copied locally, because
-        # docker.pkg.github.com is not a valid Docker registry and doesn't work with --cache-from,
-        # however, `docker pull` will fall back to other methods that do work and get the image loaded.
-        #
-        # This message comes from "docker pull":
-        #
-        # Run docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-        # WARNING: ⚠️ Failed to pull manifest by the resolved digest. This registry does not
-        #  appear to conform to the distribution registry specification; falling back to
-        #  pull by tag.  This fallback is DEPRECATED, and will be removed in a future
-        #  release.  Please contact admins of https://docker.pkg.github.com. ⚠️
-        #
-        # See: https://github.com/moby/moby/issues/41687#issuecomment-733826074 and related issues
         run: |
-          docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-          docker build --cache-from docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
+          docker build --cache-from ghcr.io/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
         env:
           DOCKER_BUILDKIT: 1
 

.github/workflows/helm-chart-repo.yaml

@@ -36,7 +36,7 @@ jobs:
           private-key: ${{ secrets.AUTOMATION_KEY }}
 
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           ref: ${{ env.ref }}
           fetch-depth: 0 # required to access tags
@@ -55,36 +55,22 @@ jobs:
           sha: ${{ env.sha }}
 
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           ref: ${{ format('bot/update-helm-chart-{0}', env.ref) }}
           fetch-depth: 0 # required to access tags
           submodules: 'true'
 
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned to v3.3.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # pinned to v3.7.0
         with:
-          registry: docker.pkg.github.com # ghcr.io not yet enabled for Azure org
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build devcontainer image
-        # We must issue a manual pull before the build so the image gets copied locally, because
-        # docker.pkg.github.com is not a valid Docker registry and doesn't work with --cache-from,
-        # however, `docker pull` will fall back to other methods that do work and get the image loaded.
-        #
-        # This message comes from "docker pull":
-        #
-        # Run docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-        # WARNING: ⚠️ Failed to pull manifest by the resolved digest. This registry does not
-        #  appear to conform to the distribution registry specification; falling back to
-        #  pull by tag.  This fallback is DEPRECATED, and will be removed in a future
-        #  release.  Please contact admins of https://docker.pkg.github.com. ⚠️
-        #
-        # See: https://github.com/moby/moby/issues/41687#issuecomment-733826074 and related issues
         run: |
-          docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-          docker build --cache-from docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
+          docker build --cache-from ghcr.io/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
         env:
           DOCKER_BUILDKIT: 1
 

.github/workflows/live-validation.yml

@@ -19,7 +19,7 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: "true"

.github/workflows/pr-validation-docs.yml

@@ -21,35 +21,21 @@ jobs:
 
     steps:
       - name: Checkout code
-        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # pinned to 4.1.7
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # pinned to 6.0.2
         with:
           fetch-depth: 0 # required to access tags
           submodules: "true"
 
       - name: Log in to GitHub Docker Registry
-        uses: docker/login-action@9780b0c442fbb1117ed29e0efdff1e18412f7567 # pinned to v3.3.0
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # pinned to v3.7.0
         with:
-          registry: docker.pkg.github.com # ghcr.io not yet enabled for Azure org
+          registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Build devcontainer image
-        # We must issue a manual pull before the build so the image gets copied locally, because
-        # docker.pkg.github.com is not a valid Docker registry and doesn't work with --cache-from,
-        # however, `docker pull` will fall back to other methods that do work and get the image loaded.
-        #
-        # This message comes from "docker pull":
-        #
-        # Run docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-        # WARNING: ⚠️ Failed to pull manifest by the resolved digest. This registry does not
-        #  appear to conform to the distribution registry specification; falling back to
-        #  pull by tag.  This fallback is DEPRECATED, and will be removed in a future
-        #  release.  Please contact admins of https://docker.pkg.github.com. ⚠️
-        #
-        # See: https://github.com/moby/moby/issues/41687#issuecomment-733826074 and related issues
         run: |
-          docker pull docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest
-          docker build --cache-from docker.pkg.github.com/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
+          docker build --cache-from ghcr.io/azure/azure-service-operator/aso-devcontainer:latest --tag devcontainer:latest .devcontainer
         env:
           DOCKER_BUILDKIT: 1