From e215c810fc5790266670dbdea93b0128171ee5d5 Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 04:54:00 +1000
Subject: [PATCH 1/2] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 95 ++-----------------------
 1 file changed, 4 insertions(+), 91 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index b4d17b0be..5512bce05 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -3,11 +3,9 @@
 
 name: Building and Pushing to MCR
 on:
-  workflow_dispatch:
-    inputs:
-      releaseTag:
-        description: 'Release tag to publish images, defaults to the latest one'
-        type: string
+  pull_request:
+    branches:
+      - main
 
 permissions:
   id-token: write
@@ -54,59 +52,6 @@ jobs:
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
           # from AZURE_REGISTRY secret is not exported from here.
 
-  publish-images-amd64:
-    runs-on:
-      labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
-    needs: prepare-variables
-    steps:
-      - uses: actions/checkout@v5
-        with:
-          ref: ${{ needs.prepare-variables.outputs.release_tag }}
-      - name: 'Login the ACR'
-        run: |
-          az login --identity 
-          az acr login -n ${{ secrets.AZURE_REGISTRY }}
-      - name: Build and publish hub-agent
-        run: |
-          make docker-build-hub-agent
-        env:
-          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish member-agent
-        run: |
-          make docker-build-member-agent
-        env:
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish refresh-token
-        run: |
-          make docker-build-refresh-token
-        env:
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      - name: Build and publish crd-installer
-        run: |
-          make docker-build-crd-installer
-        env:
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-      # Build Arc Extension for member clusters
-      # Arc-connected clusters can join fleets as member clusters through an Arc Extension.
-      # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
-      # This step packages both the fleet member agent and networking agents into a single
-      # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
-      - name: Build and publish ARC member cluster agents helm chart
-        run: |
-          make helm-package-arc-member-cluster-agents
-        env:
-          ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
-          MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
-          MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}
-
   publish-images-arm64:
     runs-on:
       labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64"]
@@ -145,42 +90,10 @@ jobs:
       - name: 'Login the ACR'
         run: |
           az login --identity
-          az acr login -n ${{ secrets.AZURE_REGISTRY }}
+          sudo az acr login -n ${{ secrets.AZURE_REGISTRY }}
       - name: 'Verify Docker CLI'
         # Note (chenyu1): the Docker installation has to be invoked with root privileges by default; for
         # simplicity reasons in this pipeline we will make no attempt to enable rootless Docker usage.
         run: |
           sudo docker version
           sudo docker info
-      - name: Build and publish hub-agent
-        # Note (chenyu1): must preserve the environment here.
-        run: |
-          sudo -E make docker-build-hub-agent
-        env:
-          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64
-      - name: Build and publish member-agent
-        # Note (chenyu1): must preserve the environment here.
-        run: |
-          sudo -E make docker-build-member-agent
-        env:
-          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64
-      - name: Build and publish refresh-token
-        # Note (chenyu1): must preserve the environment here.
-        run: |
-          sudo -E make docker-build-refresh-token
-        env:
-          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64
-      - name: Build and publish crd-installer
-        # Note (chenyu1): must preserve the environment here.
-        run: |
-          sudo -E make docker-build-crd-installer
-        env:
-          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
-          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
-          TARGET_ARCH: arm64

From fdcc810ba009adcd55a778e0e809f1635c23b20f Mon Sep 17 00:00:00 2001
From: michaelawyu <chenyu1@microsoft.com>
Date: Thu, 18 Sep 2025 05:02:49 +1000
Subject: [PATCH 2/2] Minor fixes

Signed-off-by: michaelawyu <chenyu1@microsoft.com>
---
 .github/workflows/build-publish-mcr.yml | 93 ++++++++++++++++++++++++-
 1 file changed, 90 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/build-publish-mcr.yml b/.github/workflows/build-publish-mcr.yml
index 5512bce05..d3758477a 100644
--- a/.github/workflows/build-publish-mcr.yml
+++ b/.github/workflows/build-publish-mcr.yml
@@ -3,9 +3,11 @@
 
 name: Building and Pushing to MCR
 on:
-  pull_request:
-    branches:
-      - main
+  workflow_dispatch:
+    inputs:
+      releaseTag:
+        description: 'Release tag to publish images, defaults to the latest one'
+        type: string
 
 permissions:
   id-token: write
@@ -52,6 +54,59 @@ jobs:
           # NOTE: As exporting a variable from a secret is not possible, the shared variable registry obtained
           # from AZURE_REGISTRY secret is not exported from here.
 
+  publish-images-amd64:
+    runs-on:
+      labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu"]
+    needs: prepare-variables
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          ref: ${{ needs.prepare-variables.outputs.release_tag }}
+      - name: 'Login the ACR'
+        run: |
+          az login --identity 
+          az acr login -n ${{ secrets.AZURE_REGISTRY }}
+      - name: Build and publish hub-agent
+        run: |
+          make docker-build-hub-agent
+        env:
+          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish member-agent
+        run: |
+          make docker-build-member-agent
+        env:
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish refresh-token
+        run: |
+          make docker-build-refresh-token
+        env:
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      - name: Build and publish crd-installer
+        run: |
+          make docker-build-crd-installer
+        env:
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-amd64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+      # Build Arc Extension for member clusters
+      # Arc-connected clusters can join fleets as member clusters through an Arc Extension.
+      # An Arc Extension is a packaged Helm chart that gets deployed to Arc clusters.
+      # This step packages both the fleet member agent and networking agents into a single
+      # Helm chart for Arc deployment, since Arc Extensions require all components to be bundled together.
+      - name: Build and publish ARC member cluster agents helm chart
+        run: |
+          make helm-package-arc-member-cluster-agents
+        env:
+          ARC_MEMBER_AGENT_HELMCHART_VERSION: ${{ needs.prepare-variables.outputs.arc_helmchart_version }}
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}
+          MCS_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
+          MEMBER_NET_CONTROLLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.fleet_networking_version }}
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.ARC_REGISTRY_REPO}}
+
   publish-images-arm64:
     runs-on:
       labels: [self-hosted, "1ES.Pool=1es-aks-fleet-pool-ubuntu-arm64"]
@@ -97,3 +152,35 @@ jobs:
         run: |
           sudo docker version
           sudo docker info
+      - name: Build and publish hub-agent
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-hub-agent
+        env:
+          HUB_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64
+      - name: Build and publish member-agent
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-member-agent
+        env:
+          MEMBER_AGENT_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64
+      - name: Build and publish refresh-token
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-refresh-token
+        env:
+          REFRESH_TOKEN_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64
+      - name: Build and publish crd-installer
+        # Note (chenyu1): must preserve the environment here.
+        run: |
+          sudo -E make docker-build-crd-installer
+        env:
+          CRD_INSTALLER_IMAGE_VERSION: ${{ needs.prepare-variables.outputs.release_tag }}-arm64
+          REGISTRY: ${{ secrets.AZURE_REGISTRY }}/${{ env.REGISTRY_REPO}}
+          TARGET_ARCH: arm64