docs: design Bicep extension GHCR migrations - #12951
Merged
Merged
Conversation
Copilot-Session: a636af32-e4d0-4459-a055-e653592c44b9 Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
Copilot-Session: a636af32-e4d0-4459-a055-e653592c44b9 Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
The changes add new design-note documentation only, and the Markdown content/structure appears consistent and internally coherent with no blocking issues found.
Pull request overview
Adds implementation-ready design notes describing how Radius can migrate Bicep extension publishing and consumption from ACR (biceptypes.azurecr.io) to GHCR (ghcr.io), including a phased rollout plan, compatibility constraints, and cleanup steps. It also documents a separate, optional migration for the Test-tenant functional-test extensions currently published via TEST_BICEP_TYPES_REGISTRY.
Changes:
- Define the production migration contract (package naming, tag semantics), publishing model, Bicep toolchain requirements, and phased rollout/cutover gates.
- Document cross-repo execution planning, compatibility/retirement risks, and concrete Azure/GitHub settings cleanup targets.
- Capture a separate Test-tenant design for moving functional-test extension publishing to GHCR and deleting the Terraform-managed test ACR.
File summaries
| File | Description |
|---|---|
| eng/design-notes/tools/2026-09-bicep-extension-ghcr-migration.md | Production migration design: artifact contract, publishing/consumption, Bicep upgrade considerations, phased rollout, and ACR retirement/cleanup plan. |
| eng/design-notes/tools/2026-09-test-bicep-extension-ghcr-migration.md | Optional Test-tenant migration design: GHCR targets for test extensions, workflow and cleanup approach, ACR inventory, and Terraform removal plan. |
Review details
- Files reviewed: 2/2 changed files
- Comments generated: 0
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
DariuszPorowski
self-requested a review
September 10, 2026 20:37
DariuszPorowski
left a comment
DariuszPorowski
left a comment
Member
There was a problem hiding this comment.
Three blocking design issues and one non-blocking correction. The inline comments address the proposed migration, not a runtime change in this documentation-only PR.
Copilot-Session: a636af32-e4d0-4459-a055-e653592c44b9 Signed-off-by: willdavsmith <willdavsmith@gmail.com>
willdavsmith
requested review from
DariuszPorowski
and
a balanced review from Copilot
September 14, 2026 16:18
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The publishing model and package names remain unresolved, and the test cleanup inventory misses active workflow guidance.
Get a fresh assessment by requesting another Copilot review.
Review details
Suppressed comments (1)
Previously missed (1) — in code that hasn't changed since the last review.
eng/design-notes/tools/2026-09-test-bicep-extension-ghcr-migration.md:99
- Add
.github/instructions/github-workflows.instructions.mdto this cleanup scope. Its active workflow examples still referenceTEST_BICEP_TYPES_REGISTRY(lines 49 and 58), so deleting the variable without updating this guidance would leave contributors and agents with instructions for the removed ACR path.
- Files reviewed: 2/2 changed files
- Comments generated: 2
- Review effort level: Balanced
Copilot-Session: a636af32-e4d0-4459-a055-e653592c44b9 Signed-off-by: willdavsmith <willdavsmith@gmail.com>
Copilot-Session: a636af32-e4d0-4459-a055-e653592c44b9 Signed-off-by: willdavsmith <willdavsmith@gmail.com>
DariuszPorowski
approved these changes
Sep 14, 2026
pujitha24
pushed a commit
to pujitha24/radius
that referenced
this pull request
Sep 21, 2026
…ect#12980) <!-- Thank you for contributing to Radius! Please fill out each section below so reviewers have the context they need. Sections marked optional can be removed if they do not apply. --> ## Summary <!-- Provide a concise description of what this PR does. --> Align the Bicep extension GHCR migration design with the unmerged release stack ending at `dp/release-snapshot-hardening`: radius-project#12970, reviewed at [`20bbd89a8311659ade5db65a50fb5ed98ff674fa`](https://github.com/radius-project/radius/tree/20bbd89a8311659ade5db65a50fb5ed98ff674fa). Replace the proposed `radius-project/bicep-publisher` repository and external Bicep dispatch with source-repository `GITHUB_TOKEN` publishing. Reuse read-only snapshots, immutable version staging, source/digest locks, verification, approval, alias promotion, and resume. GHCR `edge` follows `main`; `latest` tracks stable releases, while legacy ACR mappings remain during compatibility. ## Reason for change <!-- Explain why this change is needed. If it addresses a GitHub issue, link it below so it is automatically closed when this PR merges (optional). --> Related to radius-project#12937 and follow-up to merged radius-project#12951. The release stack is an implementation dependency, not the current `main` workflow layout. The previously prepared external-dispatch implementation is superseded, not included here. The reference branch still executes PR-controlled code with `packages: write` in `functional-test-cloud.yaml`. Make shared credential isolation an explicit activation prerequisite, and align the companion test-registry design with that separation. Preserve the historical ACR inventory and cleanup guidance. This is a two-document design revision only: it does not complete radius-project#12937, implement production workflows, publish artifacts, change secrets/settings, or perform a live migration. Test-tenant registry migration remains outside the production design's scope; its resources and configuration are retained. ## How to test <!-- Describe the steps a reviewer can take to verify these changes. --> The supplied patch and both final document SHA-256 hashes match. These scoped checks passed locally using cached tools without installing dependencies: ```bash npx --no-install --package=markdown-table-formatter@1.7.0 markdown-table-formatter 'eng/design-notes/tools/2026-09-*bicep-extension-ghcr-migration.md' --check npx --no-install --package=markdownlint-cli2@0.23.2 markdownlint-cli2 'eng/design-notes/tools/2026-09-*bicep-extension-ghcr-migration.md' --config .github/linters/.markdownlint-cli2.yaml npx --no-install cspell lint --config .github/linters/.cspell.yml --no-progress eng/design-notes/tools/2026-09-bicep-extension-ghcr-migration.md eng/design-notes/tools/2026-09-test-bicep-extension-ghcr-migration.md git diff --check ``` No code tests or builds are needed for this documentation-only change. Release and migration verification described in the documents is future implementation work, not performed by this PR. ## File change summary <!-- Summarize the change made in each file that was modified. --> | File | Summary of change | | ---- | ----------------- | | `eng/design-notes/tools/2026-09-bicep-extension-ghcr-migration.md` | Align production GHCR publishing with the release stack; define immutable staging, verification, promotion/resume, credential-isolation gates, and ACR compatibility while retaining the inventory and cleanup plan. | | `eng/design-notes/tools/2026-09-test-bicep-extension-ghcr-migration.md` | Align credential-separation guidance only; retain the separate, optional Test-tenant registry migration design. | --------- Signed-off-by: willdavsmith <willdavsmith@gmail.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Add technical designs for migrating Radius Bicep extension publishing and consumption from ACR to GHCR. The production design covers Radius and AWS extensions, phased rollout, parallel workstreams, compatibility, and retirement cleanup. A separate design records the optional Test-tenant
TEST_BICEP_TYPES_REGISTRYmigration.Reason for change
Provide an implementation-ready design for the cross-repository migration while keeping production and Test-tenant scope independent.
Related to #12937.
How to test
Review the rendered Markdown and run the repository Markdown checks against both files.
File change summary
eng/design-notes/tools/2026-09-bicep-extension-ghcr-migration.mdeng/design-notes/tools/2026-09-test-bicep-extension-ghcr-migration.md