Add a workflow to publish images to ACR

[ravikiranvm]

Fixes OPS-4769

• Adds a github action that triggers on pushes to main and a new release

• It can be run manually

• Follows the same approach as in OpenOps

• Tagging convention on main, release and branch

• Images build on AMD64 and ARM64 architectures

• A single manifest per tag

• We don't rebuild images on release, we promote the latest commit's image to a public one

• Merges to main and manual triggers push images to private registry. Release would push image to public registry.

• Modifies the CI build job to not run on pushes to main to avoid unnecessary builds since pushes to main triggers this build and push workflow.

Note: We will require Container Registry Repository Writer permission on public and private registries to the existing github actions service principal.

[linear]

OPS-4769

[Copilot]

🟡 Changes recommended

The new Publish workflow references non-existent action versions and has reliability issues (concurrency/tag regression risk and missing Buildx setup in jobs that invoke docker buildx).

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Adds an automated container image publishing pipeline for the OpenOps MCP HTTP-transport image, targeting Azure Container Registry (private on main pushes and public on releases), and updates CI/documentation accordingly.

Changes:

• Introduces a new Publish GitHub Actions workflow to build/push multi-arch images and to promote release images from private to public ACR.
• Updates CI to skip the Docker image build job on push events (to avoid redundant builds on main).
• Documents the published image locations and tags in the README.

File summaries

File	Description
README.md	Documents where main and release images are published and how they’re tagged.
.github/workflows/publish.yml	New workflow to build multi-arch images on main/manual runs and promote images on releases.
.github/workflows/ci.yml	Skips the image build job on push events to avoid duplicating Publish workflow builds.

Review details

Suppressed comments (1)

.github/workflows/publish.yml:130

• This job calls docker buildx imagetools create, but doesn’t set up Buildx in the job. Add docker/setup-buildx-action before the promotion step so the command works reliably across runner images.

      - name: ACR login
        run: |
          az acr login --name openops
          az acr login --name openopspublic
      - name: Promote image to the public registry

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.