Skip to content

fix(ci): build PR images without Azure service connection #2710

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Alex Castilio (alexcastilio) merged 1 commit into from
Sep 2, 2026
Merged

fix(ci): build PR images without Azure service connection #2710

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
215 changes: 110 additions & 105 deletions .azure-pipelines/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,7 +17,8 @@
# AZURE_AGENT_LINUX_ARM_SKU
# Variables (secret):
# AZURE_APP_INSIGHTS_KEY
# Service connection (Azure RM, WIF): Azure Container Networking - Build Validations - Federated
# Service connection for publishing runs (Azure RM, WIF):
# Azure Container Networking - Build Validations - Federated
# Settings: "Limit building pull requests from forked GitHub repositories" = Disable

trigger:
Expand All @@ -31,12 +32,8 @@ pr:
- main

parameters:
# TEMPORARY (revert this parameter and the isMergeGroup if/else below after
# dark-launch validation): when true, forces full merge-group behavior on any
# trigger (push to ACR, embed APP_INSIGHTS_ID, run manifests + e2e + perf).
# Use it to validate the full pipeline from a manual queue against any branch.
- name: forceMergeGroup
displayName: Force merge-group behavior (push + telemetry + tests)
- name: runE2EValidation
displayName: Publish branch images and run E2E
type: boolean
default: false

Expand All @@ -46,10 +43,10 @@ variables:
- name: imageNamespace
value: microsoft/retina
# True only when the build was triggered by a push to a merge-queue temp branch,
# OR when the forceMergeGroup parameter is checked at queue time.
# OR when the runE2EValidation parameter is checked at queue time.
# PR builds and manual queues with the checkbox off evaluate to False -> dry-run.
- name: isMergeGroup
${{ if eq(parameters.forceMergeGroup, true) }}:
${{ if eq(parameters.runE2EValidation, true) }}:
value: 'True'
${{ else }}:
value: $[ startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/') ]
Expand All @@ -72,19 +69,18 @@ jobs:
- bash: make qemu-user-static
displayName: Set up QEMU
- template: steps/setup-go.yml
- task: AzureCLI@2
displayName: Build and push retina image
env:
IS_MERGE_GROUP: $(isMergeGroup)
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
if [ "$IS_MERGE_GROUP" == "True" ]; then
- ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
- task: AzureCLI@2
displayName: Build and push retina image
env:
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
az acr login -n $(ACR_NAME)
make retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
Expand All @@ -93,12 +89,15 @@ jobs:
APP_INSIGHTS_ID=$APP_INSIGHTS_ID \
TAG=$TAG \
BUILDX_ACTION=--push
else
make retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
fi
- ${{ else }}:
- bash: |
set -euo pipefail
TAG=$(make version)
make retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
displayName: Build retina image

- job: build_windows_binaries
displayName: Build Windows Binaries
Expand Down Expand Up @@ -158,19 +157,18 @@ jobs:
}
throw "Docker daemon failed to start within $timeout seconds"
displayName: Ensure Docker daemon is running
- task: AzureCLI@2
displayName: Build and push retina Windows image
env:
IS_MERGE_GROUP: $(isMergeGroup)
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
if [ "$IS_MERGE_GROUP" == "True" ]; then
- ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
- task: AzureCLI@2
displayName: Build and push retina Windows image
env:
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
az acr login -n $(ACR_NAME)
make retina-image-win \
IMAGE_NAMESPACE=$(imageNamespace) \
Expand All @@ -182,15 +180,18 @@ jobs:
REPO_PATH=. \
TAG=$TAG
docker push $(ACR_NAME)/$(imageNamespace)/retina-agent:${TAG}-windows-ltsc$(year)-$(arch)
else
make retina-image-win \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=$(platform)/$(arch) \
WINDOWS_YEARS=$(year) \
BINARIES_PATH=output/windows_$(arch) \
REPO_PATH=. \
TAG=$TAG
fi
- ${{ else }}:
- bash: |
set -euo pipefail
TAG=$(make version)
make retina-image-win \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=$(platform)/$(arch) \
WINDOWS_YEARS=$(year) \
BINARIES_PATH=output/windows_$(arch) \
REPO_PATH=. \
TAG=$TAG
displayName: Build retina Windows image

- job: operator_images
displayName: Build Operator Images
Expand All @@ -209,19 +210,18 @@ jobs:
- bash: make qemu-user-static
displayName: Set up QEMU
- template: steps/setup-go.yml
- task: AzureCLI@2
displayName: Build and push operator image
env:
IS_MERGE_GROUP: $(isMergeGroup)
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
if [ "$IS_MERGE_GROUP" == "True" ]; then
- ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
- task: AzureCLI@2
displayName: Build and push operator image
env:
APP_INSIGHTS_ID: $(AZURE_APP_INSIGHTS_KEY)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
az acr login -n $(ACR_NAME)
make retina-operator-image \
IMAGE_NAMESPACE=$(imageNamespace) \
Expand All @@ -230,12 +230,15 @@ jobs:
APP_INSIGHTS_ID=$APP_INSIGHTS_ID \
TAG=$TAG \
BUILDX_ACTION=--push
else
make retina-operator-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
fi
- ${{ else }}:
- bash: |
set -euo pipefail
TAG=$(make version)
make retina-operator-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
displayName: Build operator image

- job: retina_shell_images
displayName: Build Retina Shell Images
Expand All @@ -254,31 +257,32 @@ jobs:
- bash: make qemu-user-static
displayName: Set up QEMU
- template: steps/setup-go.yml
- task: AzureCLI@2
displayName: Build and push retina-shell image
env:
IS_MERGE_GROUP: $(isMergeGroup)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
if [ "$IS_MERGE_GROUP" == "True" ]; then
- ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
- task: AzureCLI@2
displayName: Build and push retina-shell image
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
az acr login -n $(ACR_NAME)
make retina-shell-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
IMAGE_REGISTRY=$(ACR_NAME) \
TAG=$TAG \
BUILDX_ACTION=--push
else
make retina-shell-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
fi
- ${{ else }}:
- bash: |
set -euo pipefail
TAG=$(make version)
make retina-shell-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
displayName: Build retina-shell image

- job: kubectl_retina_images
displayName: Build Kubectl Retina Images
Expand All @@ -297,31 +301,32 @@ jobs:
- bash: make qemu-user-static
displayName: Set up QEMU
- template: steps/setup-go.yml
- task: AzureCLI@2
displayName: Build and push kubectl-retina image
env:
IS_MERGE_GROUP: $(isMergeGroup)
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
if [ "$IS_MERGE_GROUP" == "True" ]; then
- ${{ if or(eq(parameters.runE2EValidation, true), startsWith(variables['Build.SourceBranch'], 'refs/heads/gh-readonly-queue/')) }}:
- task: AzureCLI@2
displayName: Build and push kubectl-retina image
inputs:
azureSubscription: $(azureServiceConnection)
scriptType: bash
scriptLocation: inlineScript
inlineScript: |
set -euo pipefail
TAG=$(make version)
az acr login -n $(ACR_NAME)
make kubectl-retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
IMAGE_REGISTRY=$(ACR_NAME) \
TAG=$TAG \
BUILDX_ACTION=--push
else
make kubectl-retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
fi
- ${{ else }}:
- bash: |
set -euo pipefail
TAG=$(make version)
make kubectl-retina-image \
IMAGE_NAMESPACE=$(imageNamespace) \
PLATFORM=linux/$(arch) \
TAG=$TAG
displayName: Build kubectl-retina image

- job: manifests
displayName: Generate Manifests
Expand Down
Loading