From 4eefa08fdc8145ef1ac0b7178981aaf9df9453a7 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Tue, 26 May 2026 20:19:54 -0400
Subject: [PATCH 01/11] ACR Add Docker image build and provenance attestations

---
 .github/workflows/release.yaml | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index ec11a2d..bf02148 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -56,3 +56,20 @@ jobs:
           subject-name: ghcr.io/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
+
+      - name: Build and push Docker image to ACR
+        id: build
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ env.ACR_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          platforms: linux/amd64,linux/arm64
+
+      - name: Attest build provenance for ACR
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-name: ${{ env.ACR_REGISTRY }}/github/artifact-attestations-opa-provider
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true

From ee199c01c5e40f9f9ee2b867ff12b3cd15ebed0b Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 15:06:12 -0400
Subject: [PATCH 02/11] Update ACR registry references in release workflow

---
 .github/workflows/release.yaml | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index bf02148..15b976e 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,6 +49,13 @@ jobs:
           push: true
           tags: ghcr.io/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
           platforms: linux/amd64,linux/arm64
+      
+      - name: Log in to Azure Container Registry (ACR)
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ secrets.ACR_MODA_REGISTRY }}
+          username: ${{ secrets.ACR_MODA_USER }}
+          password: ${{ secrets.ACR_MODA_TOKEN }}
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
@@ -64,12 +71,12 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
-          tags: ${{ env.ACR_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          tags: ${{ env.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
           platforms: linux/amd64,linux/arm64
 
       - name: Attest build provenance for ACR
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          subject-name: ${{ env.ACR_REGISTRY }}/github/artifact-attestations-opa-provider
+          subject-name: ${{ env.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.build.outputs.digest }}
           push-to-registry: true

From fbf62b1bef6cfaa49365d0a597ab26b98ac38e73 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 15:29:21 -0400
Subject: [PATCH 03/11] Replace ACR_MODA_REGISTRY env with secrets since using
 actions secrets

federated to actions secrets being used
---
 .github/workflows/release.yaml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 15b976e..80419d1 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -71,12 +71,12 @@ jobs:
           context: .
           file: ./Dockerfile
           push: true
-          tags: ${{ env.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
           platforms: linux/amd64,linux/arm64
 
       - name: Attest build provenance for ACR
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
         with:
-          subject-name: ${{ env.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
+          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.build.outputs.digest }}
           push-to-registry: true

From f5bd16be62feb8447dd8000dea764e16ea443b77 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 17:40:46 -0400
Subject: [PATCH 04/11] Reorder ACR login step in release workflow

---
 .github/workflows/release.yaml | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 80419d1..de98bab 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -49,13 +49,6 @@ jobs:
           push: true
           tags: ghcr.io/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
           platforms: linux/amd64,linux/arm64
-      
-      - name: Log in to Azure Container Registry (ACR)
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ${{ secrets.ACR_MODA_REGISTRY }}
-          username: ${{ secrets.ACR_MODA_USER }}
-          password: ${{ secrets.ACR_MODA_TOKEN }}
 
       - name: Attest build provenance
         uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
@@ -64,6 +57,13 @@ jobs:
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
 
+      - name: Log in to Azure Container Registry (ACR)
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ secrets.ACR_MODA_REGISTRY }}
+          username: ${{ secrets.ACR_MODA_USER }}
+          password: ${{ secrets.ACR_MODA_TOKEN }}
+
       - name: Build and push Docker image to ACR
         id: build
         uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0

From 0b1f551d5aae63d59df7e80a7e8195f8bdd414eb Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 17:48:20 -0400
Subject: [PATCH 05/11] Add separate ACR release workflow

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/release_acr.yaml | 58 ++++++++++++++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 .github/workflows/release_acr.yaml

diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
new file mode 100644
index 0000000..2c50c33
--- /dev/null
+++ b/.github/workflows/release_acr.yaml
@@ -0,0 +1,58 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*.*.*'
+
+permissions:
+  contents: read
+
+jobs:
+  release:
+    name: Build and Release OCI Image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+      id-token: write
+      attestations: write
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Extract version from tag
+        id: version
+        run: |
+          # Extract the tag name (e.g., v1.0.0)
+          TAG=${GITHUB_REF#refs/tags/}
+          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
+
+      - name: Log in to Azure Container Registry (ACR)
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ secrets.ACR_MODA_REGISTRY }}
+          username: ${{ secrets.ACR_MODA_USER }}
+          password: ${{ secrets.ACR_MODA_TOKEN }}
+
+      - name: Build and push Docker image to ACR
+        id: build
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          platforms: linux/amd64,linux/arm64
+
+      - name: Attest build provenance for ACR
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
\ No newline at end of file

From 70c43b14258f3188a0f97bf2d000b71751cab46e Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 17:54:00 -0400
Subject: [PATCH 06/11] testing acr push

---
 .github/workflows/release_acr.yaml | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
index 2c50c33..b7a53c6 100644
--- a/.github/workflows/release_acr.yaml
+++ b/.github/workflows/release_acr.yaml
@@ -1,9 +1,7 @@
 name: Release
 
 on:
-  push:
-    tags:
-      - 'v*.*.*'
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -23,12 +21,9 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Extract version from tag
+      - name: Set image tag
         id: version
-        run: |
-          # Extract the tag name (e.g., v1.0.0)
-          TAG=${GITHUB_REF#refs/tags/}
-          echo "tag=${TAG}" >> $GITHUB_OUTPUT
+        run: echo "tag=v0.0.0-acr-test" >> $GITHUB_OUTPUT
 
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

From 2dd6d8e63025f22506db27e3b9abe4a12c747c2d Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 29 May 2026 17:54:27 -0400
Subject: [PATCH 07/11] rename

---
 .github/workflows/release_acr.yaml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
index b7a53c6..20fa9dd 100644
--- a/.github/workflows/release_acr.yaml
+++ b/.github/workflows/release_acr.yaml
@@ -1,4 +1,4 @@
-name: Release
+name: Release to ACR test
 
 on:
   workflow_dispatch:

From 6fa7737f81f839d507ea5149cc6b2d532deba360 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Mon, 1 Jun 2026 11:55:31 -0400
Subject: [PATCH 08/11] test release acr

---
 .github/workflows/release_acr.yaml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
index 20fa9dd..9a628ac 100644
--- a/.github/workflows/release_acr.yaml
+++ b/.github/workflows/release_acr.yaml
@@ -1,7 +1,9 @@
 name: Release to ACR test
 
 on:
-  workflow_dispatch:
+  pull_request:
+    branches:
+      - main
 
 permissions:
   contents: read

From 7022f06fdc74587e897fb25c98bd4b6f71503a0a Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Mon, 1 Jun 2026 12:09:10 -0400
Subject: [PATCH 09/11] not required to pass, push to ACR and main

---
 .github/workflows/release_acr.yaml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
index 9a628ac..33daa60 100644
--- a/.github/workflows/release_acr.yaml
+++ b/.github/workflows/release_acr.yaml
@@ -1,7 +1,8 @@
 name: Release to ACR test
 
 on:
-  pull_request:
+  workflow_dispatch:
+  push:
     branches:
       - main
 

From b8f20c0548a73856f9a0883ea73ae2636415d990 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Mon, 1 Jun 2026 12:11:45 -0400
Subject: [PATCH 10/11] moved ACR stuff to a test workflow

---
 .github/workflows/release.yaml | 24 ------------------------
 1 file changed, 24 deletions(-)

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 79ef53c..1e9403f 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -56,27 +56,3 @@ jobs:
           subject-name: ghcr.io/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
-
-      - name: Log in to Azure Container Registry (ACR)
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ${{ secrets.ACR_MODA_REGISTRY }}
-          username: ${{ secrets.ACR_MODA_USER }}
-          password: ${{ secrets.ACR_MODA_TOKEN }}
-
-      - name: Build and push Docker image to ACR
-        id: build
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
-          platforms: linux/amd64,linux/arm64
-
-      - name: Attest build provenance for ACR
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
-        with:
-          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
-          subject-digest: ${{ steps.build.outputs.digest }}
-          push-to-registry: true

From e7748fb619d8fa7339d20f56b196831f9035e0d2 Mon Sep 17 00:00:00 2001
From: Christopher Paul <chriscpaul@github.com>
Date: Fri, 12 Jun 2026 18:32:50 -0400
Subject: [PATCH 11/11] Consolidate ACR release into release.yaml, remove
 release_acr.yaml

- Remove separate release_acr.yaml test workflow
- Add ACR login, build+push, and attestation steps to release.yaml
- Both ghcr.io and ACR images are built on tag push in a single workflow
- Update checkout action to v6.0.3

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .github/workflows/release.yaml     | 26 +++++++++++++-
 .github/workflows/release_acr.yaml | 56 ------------------------------
 2 files changed, 25 insertions(+), 57 deletions(-)
 delete mode 100644 .github/workflows/release_acr.yaml

diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml
index 1e9403f..2dbff33 100644
--- a/.github/workflows/release.yaml
+++ b/.github/workflows/release.yaml
@@ -19,7 +19,7 @@ jobs:
       attestations: write
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           persist-credentials: false
 
@@ -56,3 +56,27 @@ jobs:
           subject-name: ghcr.io/github/artifact-attestations-opa-provider
           subject-digest: ${{ steps.push.outputs.digest }}
           push-to-registry: true
+
+      - name: Log in to Azure Container Registry (ACR)
+        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
+        with:
+          registry: ${{ secrets.ACR_MODA_REGISTRY }}
+          username: ${{ secrets.ACR_MODA_USER }}
+          password: ${{ secrets.ACR_MODA_TOKEN }}
+
+      - name: Build and push Docker image to ACR
+        id: build
+        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
+        with:
+          context: .
+          file: ./Dockerfile
+          push: true
+          tags: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
+          platforms: linux/amd64,linux/arm64
+
+      - name: Attest build provenance for ACR
+        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
+        with:
+          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/artifact-attestations-opa-provider
+          subject-digest: ${{ steps.build.outputs.digest }}
+          push-to-registry: true
diff --git a/.github/workflows/release_acr.yaml b/.github/workflows/release_acr.yaml
deleted file mode 100644
index 33daa60..0000000
--- a/.github/workflows/release_acr.yaml
+++ /dev/null
@@ -1,56 +0,0 @@
-name: Release to ACR test
-
-on:
-  workflow_dispatch:
-  push:
-    branches:
-      - main
-
-permissions:
-  contents: read
-
-jobs:
-  release:
-    name: Build and Release OCI Image
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read
-      packages: write
-      id-token: write
-      attestations: write
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
-      - name: Set image tag
-        id: version
-        run: echo "tag=v0.0.0-acr-test" >> $GITHUB_OUTPUT
-
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0
-
-      - name: Log in to Azure Container Registry (ACR)
-        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
-        with:
-          registry: ${{ secrets.ACR_MODA_REGISTRY }}
-          username: ${{ secrets.ACR_MODA_USER }}
-          password: ${{ secrets.ACR_MODA_TOKEN }}
-
-      - name: Build and push Docker image to ACR
-        id: build
-        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
-        with:
-          context: .
-          file: ./Dockerfile
-          push: true
-          tags: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider:${{ steps.version.outputs.tag }}
-          platforms: linux/amd64,linux/arm64
-
-      - name: Attest build provenance for ACR
-        uses: actions/attest-build-provenance@a2bbfa25375fe432b6a289bc6b6cd05ecd0c4c32 # v4.1.0
-        with:
-          subject-name: ${{ secrets.ACR_MODA_REGISTRY }}/github/artifact-attestations-opa-provider
-          subject-digest: ${{ steps.build.outputs.digest }}
-          push-to-registry: true
\ No newline at end of file