From 85d19ac59f67d0f6ee5beaaa8dbc222954ec6434 Mon Sep 17 00:00:00 2001
From: tranch <tranch.xiao@gmail.com>
Date: Thu, 9 Jul 2026 17:21:21 +0800
Subject: Push build images to ACR

Add an ACR publish step after the existing GHCR publish and signing flow. The step is gated to non-PR default-branch runs and only executes when ACR_REGISTRY and ACR_NAMESPACE repository variables are set.

Verification: ruby YAML parser loaded .github/workflows/build.yml successfully.
---
 .github/workflows/build.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

(limited to '.github')

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 90371c8..b822ac6 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -163,3 +163,23 @@ jobs:
           DIGEST: ${{ steps.push-image.outputs.digest }}
         run: |
           cosign sign -y --key env://COSIGN_PRIVATE_KEY ${IMAGE_REGISTRY}/${IMAGE_NAME}@${DIGEST}
+
+      - name: Push To ACR
+        if: |
+          github.event_name != 'pull_request' &&
+          github.ref == format('refs/heads/{0}', github.event.repository.default_branch) &&
+          vars.ACR_REGISTRY != '' &&
+          vars.ACR_NAMESPACE != ''
+        env:
+          ACR_REGISTRY: ${{ vars.ACR_REGISTRY }}
+          ACR_NAMESPACE: ${{ vars.ACR_NAMESPACE }}
+          ACR_USERNAME: ${{ secrets.ACR_USERNAME }}
+          ACR_PASSWORD: ${{ secrets.ACR_PASSWORD }}
+          ALIAS_TAGS: ${{ steps.gen-build-tags.outputs.alias_tags }}
+        run: |
+          set -euo pipefail
+          echo "$ACR_PASSWORD" | sudo -E podman login "$ACR_REGISTRY" -u "$ACR_USERNAME" --password-stdin
+
+          for tag in ${ALIAS_TAGS}; do
+            sudo -E podman push "${IMAGE_NAME}:${tag}" "${ACR_REGISTRY}/${ACR_NAMESPACE}/${IMAGE_NAME}:${tag}"
+          done
-- 
cgit v1.2.3