Update ImageBuilder to bootstrap updater script

[dagood]

• For https://github.com/microsoft/go-lab/issues/489

[Copilot]

Pull request overview

This PR updates the repo’s bundled eng/docker-tools infrastructure to support bootstrapping updates via an ImageBuilder image pinned by digest, and aligns pipeline templates with recent docker-tools behavior changes.

Changes:

• Add eng/docker-tools/Update-ImageBuilder.ps1 to resolve an ImageBuilder multi-arch digest and run update against the repo.
• Pin the ImageBuilder image reference in docker-images.yml to a @sha256: digest (while using latest for resolution).
• Simplify/modernize pipeline templates: remove the deprecated setup-service-connections stage template, remove useOciArtifactForImageInfo branching, and add runPostBuildOnFailure to control Post_Build behavior.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
eng/docker-tools/Update-ImageBuilder.ps1	New helper script to resolve ImageBuilder digest and run the updater in-container.
eng/docker-tools/templates/variables/docker-images.yml	Updates pinned ImageBuilder image reference to include a digest.
eng/docker-tools/templates/steps/set-dry-run.yml	Fixes YAML parameter list syntax for publishConfig.
eng/docker-tools/templates/stages/setup-service-connections.yml	Removes the deprecated service-connection initialization stage template.
eng/docker-tools/templates/stages/publish.yml	Removes useOciArtifactForImageInfo parameter passthrough.
eng/docker-tools/templates/stages/dotnet/publish.yml	Removes useOciArtifactForImageInfo parameter passthrough.
eng/docker-tools/templates/stages/dotnet/build-test-publish-repo.yml	Adds runPostBuildOnFailure and removes useOciArtifactForImageInfo passthrough.
eng/docker-tools/templates/stages/dotnet/build-and-test.yml	Adds runPostBuildOnFailure passthrough.
eng/docker-tools/templates/stages/build-and-test.yml	Adds runPostBuildOnFailure to allow Post_Build on failure via succeededOrFailed().
eng/docker-tools/templates/jobs/publish.yml	Removes OCI-artifact-based publish path; always uses git-based publishImageInfo.

Comments suppressed due to low confidence (1)

eng/docker-tools/Update-ImageBuilder.ps1:77

• After preserving tags, build the final pinned reference from the full name[:tag] (without digest) so the update argument matches the intended pinned format (e.g. name:latest@sha256:...).

$repository = Get-RepositoryName $ImageBuilderImage
$imageBuilderRef = "$repository@$($digest.Trim())"

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

Docker-tools upgrade looks compatible! No pipeline, variable, manifest, or Dockerfile changes are needed to stay compatible with this docker-tools update.

Summary of changes reviewed:

• eng/docker-tools/templates/stages/dotnet/build-and-test.yml and build-test-publish-repo.yml: Added new optional runPostBuildOnFailure parameter (defaults to false). Since it is optional with a default, no changes are needed in the calling pipelines.
• build-test-publish-repo.yml: Removed useOciArtifactForImageInfo parameter. Confirmed it is not referenced anywhere in eng/pipeline/, so no breakage.
• eng/docker-tools/templates/variables/docker-images.yml: Updated imageNames.imageBuilderName from a build-number tag to a pinned digest reference. Internal ImageBuilder version bump with no API surface change.
• eng/docker-tools/Update-ImageBuilder.ps1: New helper script for updating bundled docker-tools. Not referenced from any local pipeline or build script.

All template paths referenced by eng/pipeline/ files continue to exist at their expected paths.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

Generated by Docker-tools Upgrade Compatibility Review Agent for #666 · 24.4 AIC · ⌖ 8.16 AIC · ⊞ 5.7K · ◷