From 5e611907d45a3a26d8fb446af063dd86c814c998 Mon Sep 17 00:00:00 2001
From: dotnet-docker-bot <60522487+dotnet-docker-bot@users.noreply.github.com>
Date: Fri, 19 Jun 2026 09:24:58 -0700
Subject: [PATCH] Update common Docker engineering infrastructure with latest

---
 eng/docker-tools/templates/jobs/publish.yml   | 45 +++++++++++++------
 .../templates/stages/build-and-test.yml       |  2 +-
 .../stages/dotnet/build-test-publish-repo.yml |  5 +++
 .../templates/stages/dotnet/publish.yml       |  4 ++
 eng/docker-tools/templates/stages/publish.yml |  5 +++
 5 files changed, 46 insertions(+), 15 deletions(-)

diff --git a/eng/docker-tools/templates/jobs/publish.yml b/eng/docker-tools/templates/jobs/publish.yml
index 5839be2d7..3adc41079 100644
--- a/eng/docker-tools/templates/jobs/publish.yml
+++ b/eng/docker-tools/templates/jobs/publish.yml
@@ -15,6 +15,11 @@ parameters:
   # Service connections not in publishConfig.RegistryAuthentication that need OIDC
   # token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
   additionalServiceConnections: []
+  # When true, the merged image info is published as an OCI artifact to the publish
+  # registry instead of being committed to the GitHub versions repo. Note that the
+  # `publishImageInfo` variable must also be set to 'true' for either form of image
+  # info publishing to run.
+  useOciArtifactForImageInfo: false
 
 jobs:
 - job: Publish
@@ -217,20 +222,32 @@ jobs:
       acr: ${{ parameters.publishConfig.PublishRegistry }}
       dataFile: $(artifactsPath)/eol-annotation-data/eol-annotation-data.json
 
-  - script: >
-      $(runImageBuilderCmd) publishImageInfo
-      '$(imageInfoContainerDir)/full-image-info-new.json'
-      '$(gitHubVersionsRepoInfo.userName)'
-      '$(gitHubVersionsRepoInfo.email)'
-      $(gitHubVersionsRepoInfo.authArgs)
-      --git-owner '$(gitHubVersionsRepoInfo.org)'
-      --git-repo '$(gitHubVersionsRepoInfo.repo)'
-      --git-branch '$(gitHubVersionsRepoInfo.branch)'
-      --git-path '$(gitHubImageInfoVersionsPath)'
-      $(dryRunArg)
-      $(imageBuilder.commonCmdArgs)
-    condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
-    displayName: Publish Image Info
+  - ${{ if eq(parameters.useOciArtifactForImageInfo, true) }}:
+    - script: >
+        $(runAuthedImageBuilderCmd) publishImageInfoArtifact
+        '$(imageInfoContainerDir)/full-image-info-new.json'
+        $(dryRunArg)
+        $(imageBuilder.commonCmdArgs)
+      env:
+        SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+        SYSTEM_OIDCREQUESTURI: $(System.OidcRequestUri)
+      condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
+      displayName: Publish Image Info
+  - ${{ else }}:
+    - script: >
+        $(runImageBuilderCmd) publishImageInfo
+        '$(imageInfoContainerDir)/full-image-info-new.json'
+        '$(gitHubVersionsRepoInfo.userName)'
+        '$(gitHubVersionsRepoInfo.email)'
+        $(gitHubVersionsRepoInfo.authArgs)
+        --git-owner '$(gitHubVersionsRepoInfo.org)'
+        --git-repo '$(gitHubVersionsRepoInfo.repo)'
+        --git-branch '$(gitHubVersionsRepoInfo.branch)'
+        --git-path '$(gitHubImageInfoVersionsPath)'
+        $(dryRunArg)
+        $(imageBuilder.commonCmdArgs)
+      condition: and(succeeded(), eq(variables['publishImageInfo'], 'true'))
+      displayName: Publish Image Info
 
   # Task displayNames names are hardcoded to reference the task prefix used by 1ES official
   # pipelines in eng/docker-tools/templates/1es-official.yml.
diff --git a/eng/docker-tools/templates/stages/build-and-test.yml b/eng/docker-tools/templates/stages/build-and-test.yml
index 5ea4b4b36..d21e8de90 100644
--- a/eng/docker-tools/templates/stages/build-and-test.yml
+++ b/eng/docker-tools/templates/stages/build-and-test.yml
@@ -212,7 +212,7 @@ stages:
 ################################################################################
 - stage: Post_Build
   dependsOn: Build
-  condition: and(succeededOrFailed(), contains(variables['stages'], 'build'))
+  condition: and(succeeded(), contains(variables['stages'], 'build'))
   jobs:
   - template: /eng/docker-tools/templates/jobs/post-build.yml@self
     parameters:
diff --git a/eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml b/eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml
index c590a5287..eaf153c2c 100644
--- a/eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml
+++ b/eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml
@@ -32,6 +32,10 @@ parameters:
   # Publish parameters
   customPublishInitSteps: []
 
+  # When true, the merged image info is published as an OCI artifact to the publish
+  # registry instead of being committed to the GitHub versions repo.
+  useOciArtifactForImageInfo: false
+
   # Additional service connections not in publishConfig.RegistryAuthentication
   # that need OIDC token access (e.g., kusto, marStatus). Shape: [{ name: string }]
   additionalServiceConnections: []
@@ -82,3 +86,4 @@ stages:
     additionalServiceConnections: ${{ parameters.additionalServiceConnections }}
     sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     versionsRepoRef: ${{ parameters.versionsRepoRef }}
+    useOciArtifactForImageInfo: ${{ parameters.useOciArtifactForImageInfo }}
diff --git a/eng/docker-tools/templates/stages/dotnet/publish.yml b/eng/docker-tools/templates/stages/dotnet/publish.yml
index 5cac237b9..7bf845ee6 100644
--- a/eng/docker-tools/templates/stages/dotnet/publish.yml
+++ b/eng/docker-tools/templates/stages/dotnet/publish.yml
@@ -16,6 +16,9 @@ parameters:
   # Service connections not in publishConfig.RegistryAuthentication that need OIDC
   # token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
   additionalServiceConnections: []
+  # When true, the merged image info is published as an OCI artifact to the publish
+  # registry instead of being committed to the GitHub versions repo.
+  useOciArtifactForImageInfo: false
 
 stages:
 - template: /eng/docker-tools/templates/stages/publish.yml@self
@@ -30,6 +33,7 @@ stages:
     sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
     versionsRepoRef: ${{ parameters.versionsRepoRef }}
     overrideImageInfoCommit: ${{ parameters.overrideImageInfoCommit }}
+    useOciArtifactForImageInfo: ${{ parameters.useOciArtifactForImageInfo }}
 
     customPublishInitSteps:
     - pwsh: |
diff --git a/eng/docker-tools/templates/stages/publish.yml b/eng/docker-tools/templates/stages/publish.yml
index 2c17283ec..e6575e4f1 100644
--- a/eng/docker-tools/templates/stages/publish.yml
+++ b/eng/docker-tools/templates/stages/publish.yml
@@ -29,6 +29,10 @@ parameters:
   # token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
   additionalServiceConnections: []
 
+  # When true, the merged image info is published as an OCI artifact to the publish
+  # registry instead of being committed to the GitHub versions repo.
+  useOciArtifactForImageInfo: false
+
 ################################################################################
 # Publish Images
 ################################################################################
@@ -86,3 +90,4 @@ stages:
       versionsRepoPath: ${{ parameters.versionsRepoPath }}
       overrideImageInfoCommit: ${{ parameters.overrideImageInfoCommit }}
       additionalServiceConnections: ${{ parameters.additionalServiceConnections }}
+      useOciArtifactForImageInfo: ${{ parameters.useOciArtifactForImageInfo }}