Mirror MCR azurite/azure-cli images to GHCR and pull from there

mcr.microsoft.com rate-limits anonymous pulls (toomanyrequests), which
intermittently fails the azurite + create_azure_blob_containers services
during go-mantis CI. Add a weekly workflow that mirrors both images into
ghcr.io/sublime-security, and point the compose services at the mirror so
CI pulls from a registry we control.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: markt-sublime

.github/workflows/mirror-mcr-images.yml

@@ -0,0 +1,38 @@
+name: Mirror MCR images to GHCR
+
+# Azurite and azure-cli are pulled from mcr.microsoft.com on every go-mantis CI run.
+# MCR rate-limits anonymous pulls (toomanyrequests), which flakes CI. Mirror them into
+# our own GHCR namespace so CI pulls from a registry we control instead of MCR.
+on:
+  schedule:
+    - cron: "0 6 * * 1" # weekly, Monday 06:00 UTC
+  workflow_dispatch: {}
+
+jobs:
+  mirror:
+    name: Mirror MCR images to GHCR
+    runs-on: ubuntu-22.04
+
+    permissions:
+      packages: write
+
+    strategy:
+      fail-fast: false
+      matrix:
+        image:
+          - src: mcr.microsoft.com/azure-storage/azurite:latest
+            dst: ghcr.io/sublime-security/azurite:latest
+          - src: mcr.microsoft.com/azure-cli:latest
+            dst: ghcr.io/sublime-security/azure-cli:latest
+
+    steps:
+      - name: Log in to GHCR
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      # imagetools copies the multi-arch manifest list registry-to-registry without a local pull.
+      - name: Copy ${{ matrix.image.src }} to ${{ matrix.image.dst }}
+        run: docker buildx imagetools create --tag ${{ matrix.image.dst }} ${{ matrix.image.src }}

docker-compose.yml

@@ -113,7 +113,8 @@ services:
       - sublime_create_buckets
   sublime_azurite:
       container_name: sublime_azurite
-      image: mcr.microsoft.com/azure-storage/azurite
+      # mirrored from mcr.microsoft.com to dodge MCR anonymous-pull rate limits in CI
+      image: ghcr.io/sublime-security/azurite:latest
       restart: unless-stopped
       networks:
         - net
@@ -125,7 +126,8 @@ services:
         - azurite_data:/data
       command: azurite --blobHost 0.0.0.0 --queueHost 0.0.0.0 --tableHost 0.0.0.0 --location /data --skipApiVersionCheck
   sublime_create_azure_blob_containers:
-    image: mcr.microsoft.com/azure-cli
+    # mirrored from mcr.microsoft.com to dodge MCR anonymous-pull rate limits in CI
+    image: ghcr.io/sublime-security/azure-cli:latest
     depends_on:
       - sublime_azurite
     networks: