Skip to content

Commit 15eb612

Browse files
dotnet-docker-botdotnet-docker-bot
committed
Update common Docker engineering infrastructure with latest
1 parent 16c04cf commit 15eb612

11 files changed

Lines changed: 133 additions & 17 deletions

‎eng/docker-tools/CHANGELOG.md‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,26 @@ All breaking changes and new features in `eng/docker-tools` will be documented i
44

55
---
66

7+
## 2026-03-12: Service connection OIDC changes
8+
9+
- Pull request: [#2013](https://github.com/dotnet/docker-tools/pull/2013)
10+
- Issue: [#2012](https://github.com/dotnet/docker-tools/issues/2012)
11+
12+
`setup-service-connections.yml` has been removed. Azure DevOps no longer
13+
issues OIDC tokens for service connections referenced in a separate stage.
14+
Service connections are now referenced per-job via
15+
`reference-service-connections.yml`.
16+
17+
**How to update:**
18+
19+
- Remove any `serviceConnections` parameters passed to `1es-official.yml` or
20+
`1es-unofficial.yml` - they are no longer accepted.
21+
- Remove any calls to `setup-service-connections.yml` from stage templates.
22+
- Non-registry service connections (e.g., kusto, marStatus) should be passed
23+
via `additionalServiceConnections` to the job templates that need them.
24+
25+
---
26+
727
## 2026-03-04: Pre-build validation gated by `preBuildTestScriptPath` variable
828

929
The `PreBuildValidation` job condition now checks the new `preBuildTestScriptPath` variable instead of `testScriptPath`.

‎eng/docker-tools/templates/1es-official.yml‎

Lines changed: 0 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -17,9 +17,6 @@ parameters:
1717
- name: stages
1818
type: stageList
1919
default: []
20-
- name: serviceConnections
21-
type: object
22-
default: []
2320
- name: pool
2421
type: object
2522
default:
@@ -62,9 +59,4 @@ extends:
6259
tsa:
6360
enabled: true
6461
stages:
65-
- ${{ if gt(length(parameters.serviceConnections), 0) }}:
66-
- template: /eng/docker-tools/templates/stages/setup-service-connections.yml@self
67-
parameters:
68-
pool: ${{ parameters.pool }}
69-
serviceConnections: ${{ parameters.serviceConnections }}
7062
- ${{ parameters.stages }}

‎eng/docker-tools/templates/1es-unofficial.yml‎

Lines changed: 0 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,6 @@ parameters:
1919
- name: stages
2020
type: stageList
2121
default: []
22-
# 1ES Pipeline Template parameters
23-
- name: serviceConnections
24-
type: object
25-
default: []
2622
- name: pool
2723
type: object
2824
default:
@@ -71,9 +67,4 @@ extends:
7167
tsa:
7268
enabled: true
7369
stages:
74-
- ${{ if gt(length(parameters.serviceConnections), 0) }}:
75-
- template: /eng/docker-tools/templates/stages/setup-service-connections.yml@self
76-
parameters:
77-
pool: ${{ parameters.pool }}
78-
serviceConnections: ${{ parameters.serviceConnections }}
7970
- ${{ parameters.stages }}

‎eng/docker-tools/templates/jobs/build-images.yml‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,15 @@ jobs:
4242
cleanupDocker: true
4343
customInitSteps: ${{ parameters.customInitSteps }}
4444
- ${{ parameters.customBuildInitSteps }}
45+
- template: /eng/docker-tools/templates/steps/reference-service-connections.yml@self
46+
parameters:
47+
publishConfig: ${{ parameters.publishConfig }}
48+
dockerClientOS: ${{ parameters.dockerClientOS }}
49+
usesRegistries:
50+
- ${{ parameters.publishConfig.BuildRegistry.server }}
51+
${{ if parameters.storageAccountServiceConnection }}:
52+
serviceConnections:
53+
- name: ${{ parameters.storageAccountServiceConnection.name }}
4554
- template: /eng/docker-tools/templates/steps/set-image-info-path-var.yml@self
4655
parameters:
4756
publicSourceBranch: $(publicSourceBranch)

‎eng/docker-tools/templates/jobs/copy-base-images.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,11 @@ jobs:
4343
publishConfig: ${{ parameters.publishConfig }}
4444
customInitSteps: ${{ parameters.customInitSteps }}
4545
versionsRepoRef: ${{ parameters.versionsRepoRef }}
46+
- template: /eng/docker-tools/templates/steps/reference-service-connections.yml@self
47+
parameters:
48+
publishConfig: ${{ parameters.publishConfig }}
49+
usesRegistries:
50+
- ${{ parameters.acr.server }}
4651
- ${{ parameters.customCopyBaseImagesInitSteps }}
4752
- template: /eng/docker-tools/templates/steps/copy-base-images.yml@self
4853
parameters:

‎eng/docker-tools/templates/jobs/publish.yml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,9 @@ parameters:
1212
# When true, overrides the commit SHA in merged image info files to use the current repository commit.
1313
# This ensures that updated images reference the correct commit in their commitUrl properties.
1414
overrideImageInfoCommit: false
15+
# Service connections not in publishConfig.RegistryAuthentication that need OIDC
16+
# token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
17+
additionalServiceConnections: []
1518

1619
jobs:
1720
- job: Publish
@@ -53,6 +56,14 @@ jobs:
5356
versionsRepoRef: ${{ parameters.versionsRepoRef }}
5457
customInitSteps: ${{ parameters.customInitSteps }}
5558

59+
- template: /eng/docker-tools/templates/steps/reference-service-connections.yml@self
60+
parameters:
61+
publishConfig: ${{ parameters.publishConfig }}
62+
usesRegistries:
63+
- ${{ parameters.publishConfig.BuildRegistry.server }}
64+
- ${{ parameters.publishConfig.PublishRegistry.server }}
65+
serviceConnections: ${{ parameters.additionalServiceConnections }}
66+
5667
- template: /eng/docker-tools/templates/steps/retain-build.yml@self
5768

5869
- pwsh: |

‎eng/docker-tools/templates/jobs/sign-images.yml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -30,6 +30,12 @@ jobs:
3030
publishConfig: ${{ parameters.publishConfig }}
3131
envFilePath: $(signingEnvFilePath)
3232

33+
- template: /eng/docker-tools/templates/steps/reference-service-connections.yml@self
34+
parameters:
35+
publishConfig: ${{ parameters.publishConfig }}
36+
usesRegistries:
37+
- ${{ parameters.publishConfig.BuildRegistry.server }}
38+
3339
# Download merged image-info artifact from Post_Build stage (or from a previous pipeline run)
3440
- template: /eng/docker-tools/templates/steps/download-build-artifact.yml@self
3541
parameters:

‎eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,10 @@ parameters:
3232
# Publish parameters
3333
customPublishInitSteps: []
3434

35+
# Additional service connections not in publishConfig.RegistryAuthentication
36+
# that need OIDC token access (e.g., kusto, marStatus). Shape: [{ name: string }]
37+
additionalServiceConnections: []
38+
3539
# Other common parameters
3640
internalProjectName: null
3741
publicProjectName: null
@@ -75,5 +79,6 @@ stages:
7579
internalProjectName: ${{ parameters.internalProjectName }}
7680
publicProjectName: ${{ parameters.publicProjectName }}
7781
publishConfig: ${{ parameters.publishConfig }}
82+
additionalServiceConnections: ${{ parameters.additionalServiceConnections }}
7883
sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
7984
versionsRepoRef: ${{ parameters.versionsRepoRef }}

‎eng/docker-tools/templates/stages/dotnet/publish.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,9 @@ parameters:
1313
sourceBuildPipelineRunId: ''
1414
versionsRepoRef: null
1515
overrideImageInfoCommit: false
16+
# Service connections not in publishConfig.RegistryAuthentication that need OIDC
17+
# token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
18+
additionalServiceConnections: []
1619

1720
stages:
1821
- template: /eng/docker-tools/templates/stages/publish.yml@self
@@ -22,6 +25,7 @@ stages:
2225
publishConfig: ${{ parameters.publishConfig }}
2326
isStandalonePublish: ${{ parameters.isStandalonePublish }}
2427
customInitSteps: ${{ parameters.customInitSteps }}
28+
additionalServiceConnections: ${{ parameters.additionalServiceConnections }}
2529
sourceBuildPipelineDefinitionId: ${{ parameters.sourceBuildPipelineDefinitionId }}
2630
sourceBuildPipelineRunId: ${{ parameters.sourceBuildPipelineRunId }}
2731
versionsRepoRef: ${{ parameters.versionsRepoRef }}

‎eng/docker-tools/templates/stages/publish.yml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,10 @@ parameters:
2525
# internally built images still reference public Dockerfiles.
2626
overrideImageInfoCommit: false
2727

28+
# Service connections not in publishConfig.RegistryAuthentication that need OIDC
29+
# token access during publish (e.g., kusto, marStatus). Shape: [{ name: string }]
30+
additionalServiceConnections: []
31+
2832
################################################################################
2933
# Publish Images
3034
################################################################################
@@ -77,3 +81,4 @@ stages:
7781
versionsRepoRef: ${{ parameters.versionsRepoRef }}
7882
versionsRepoPath: ${{ parameters.versionsRepoPath }}
7983
overrideImageInfoCommit: ${{ parameters.overrideImageInfoCommit }}
84+
additionalServiceConnections: ${{ parameters.additionalServiceConnections }}

0 commit comments

Comments
 (0)