build-publish-mcr.yml

# This Github Action will build and publish images to Azure Container Registry(ACR), from where the published images will be
# automatically pushed to the trusted registry, Microsoft Container Registry(MCR).

name: Building and Pushing to MCR
on:
  workflow_dispatch:
    inputs:
      releaseTag:
        description: 'Release tag to publish images, defaults to the latest one'
        type: string

permissions:
  id-token: write
  contents: read

env:
  # `public` indicates images to MCR wil be publicly available, and will be removed in the final MCR images
  REGISTRY_REPO: public/aks/fleet
  ARC_REGISTRY_REPO: public/microsoft.fleetmember

jobs:
  prepare-variables:
    runs-on: ubuntu-latest
    outputs:
      release_tag: ${{ steps.vars.outputs.release_tag }}
      fleet_networking_version: ${{ steps.vars.outputs.fleet_networking_version }}
      arc_helmchart_version: ${{ steps.vars.outputs.arc_helmchart_version }}
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - name: 'Set output variables'
        id: vars
        run: |
          # set the image version
          RELEASE_TAG=${{ inputs.releaseTag }}
          if [ -z "$RELEASE_TAG" ]; then
            RELEASE_TAG=`git describe --tags $(git rev-list --tags --max-count=1)`
            echo "The user input release tag is empty, will use the latest tag $RELEASE_TAG."
          fi
          echo "release_tag=$RELEASE_TAG" >> $GITHUB_OUTPUT

          # Strip 'v' prefix from RELEASE_TAG for helm chart version
          ARC_HELMCHART_VERSION="${RELEASE_TAG#v}"
          echo "arc_helmchart_version=$ARC_HELMCHART_VERSION" >> $GITHUB_OUTPUT
          echo "Using Arc Helm Chart version: $ARC_HELMCHART_VERSION"

          # Fetch the latest fleet-networking version
          # NOTE: The fleet-networking image must be cut and pushed to MCR first before retrieving this version
          FLEET_NETWORKING_VERSION="${FLEET_NETWORKING_VERSION:-$(curl "https://api.github.com/repos/Azure/fleet-networking/tags" | jq -r '.[0].name')}"
          echo "fleet_networking_version=$FLEET_NETWORKING_VERSION" >> $GITHUB_OUTPUT
          echo "Using Fleet Networking version: $FLEET_NETWORKING_VERSION"

          # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
          # from AZURE_REGISTRY secret is not exported from here.

  publish-images:
    runs-on:
      labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
    needs: prepare-variables
    steps:
      - uses: actions/checkout@v4
        with:
          ref: ${{ needs.prepare-variables.outputs.release_tag }}
      - name: 'Login the ACR'
        run: |
          az login --identity 
          az acr login -n ${{ secrets.AZURE_REGISTRY }}
      - name: Build and publish hub-agent
        run: |
          make docker-build-hub-agent
        env:
          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
      - name: Build and publish member-agent
        run: |
          make docker-build-member-agent
        env:
          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
      - name: Build and publish refresh-token
        run: |
          make docker-build-refresh-token
        env:
          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
      - name: Build and publish crd-installer
        run: |
          make docker-build-crd-installer
        env:
          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
      # Build Arc Extension for member clusters
      # Arc-connected clusters can join fleets as member clusters through an Arc Extension.
      # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
      # This step packages both the fleet member agent and networking agents into a single
      # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
      - name: Build and publish ARC member cluster agents helm chart
        run: |
          make helm-package-arc-member-cluster-agents
        env:
          ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
          MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
          MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}