Separate Registry Endpoints from Authentication in PublishConfig

[lbussell]

Fixes #1914.

Problem

The current PublishConfiguration tightly couples registry endpoints with authentication details. Each RegistryConfiguration embeds its own ServiceConnection, ResourceGroup, and Subscription, making it difficult to:

• Share authentication credentials across multiple registries
• Clearly separate "which registry to use" from "how to authenticate"
• Support non-ACR registries cleanly

Changes

Refactored PublishConfiguration to separate concerns:

New types:

• RegistryEndpoint - Holds only the registry server address
• RegistryAuthentication - Holds Server + ServiceConnection + ACR metadata (ResourceGroup, Subscription)

New schema:

{
  "PublishConfiguration": {
    "BuildRegistry": { "Server": "build.azurecr.io" },
    "PublishRegistry": { "Server": "publish.azurecr.io" },
    "InternalMirrorRegistry": { "Server": "internal-mirror.azurecr.io" },
    "PublicMirrorRegistry": { "Server": "public-mirror.azurecr.io" },
    "RegistryAuthentication": [
      {
        "Server": "build.azurecr.io",
        "ServiceConnection": { "Name": "...", "Id": "...", "TenantId": "...", "ClientId": "..." },
        "ResourceGroup": "rg-build",
        "Subscription": "sub-build"
      },
      {
        "Server": "publish.azurecr.io",
        "ServiceConnection": { "Name": "...", "Id": "...", "TenantId": "...", "ClientId": "..." },
        "ResourceGroup": "rg-publish",
        "Subscription": "sub-publish"
      }
    ]
  }
}

Multiple registries can now share authentication by referencing the same server in RegistryAuthentication. The authentication is looked up by server address using FindRegistryAuthentication().

Registry Endpoints Added:

• BuildRegistry - Images are built and pushed here before testing and publishing
• PublishRegistry - Images are copied from BuildRegistry to here during publishing
• InternalMirrorRegistry - External image dependencies are mirrored here
• PublicMirrorRegistry - External images are mirrored here with anonymous pull access for public PR validation

Files changed:

• Added RegistryEndpoint.cs - Registry endpoint record with only Server property
• Added RegistryAuthentication.cs - Authentication record with Server, ServiceConnection, ResourceGroup, Subscription
• Added RegistryExtensions.cs - Extension methods for registry operations
• Updated PublishConfiguration.cs - Now uses RegistryEndpoint for registry references and List<RegistryAuthentication> for auth lookup
• Updated ConfigurationExtensions.cs - Added FindRegistryAuthentication() and GetRegistryResource() methods
• Added PublishConfigurationBindingTests.cs - Tests for config binding from JSON
• Updated all consumers to use new lookup via FindRegistryAuthentication()

Breaking change: appsettings.json/PublishConfiguration schema has changed. RegistryAuthentication is now a list keyed by Server instead of a dictionary.

[Copilot]

Pull request overview

This PR refactors PublishConfiguration to separate registry endpoint addresses from authentication details, making it easier to share credentials across registries and support non-ACR registries.

Changes:

• Introduced RegistryEndpoint and RegistryAuthentication types to separate concerns
• Changed PublishConfiguration schema to use RegistryEndpoint for registry references and a list of RegistryAuthentication for credential lookup
• Removed subscription and resource group CLI arguments from commands, moving this data to the publish configuration
• Updated all consumers to use new lookup methods (FindRegistryAuthentication, GetRegistryResource)

Reviewed changes

Copilot reviewed 25 out of 25 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
RegistryEndpoint.cs	New record type holding registry server address only
RegistryAuthentication.cs	New record type for authentication and Azure metadata
RegistryExtensions.cs	Extension methods for registry operations
PublishConfiguration.cs	Updated to use new types and lookup structure
ConfigurationExtensions.cs	Added lookup methods for authentication and resource IDs
RegistryResolver.cs	Updated to use RegistryAuthentication instead of RegistryConfiguration
RegistryManifestClientFactory.cs	Updated to use new authentication lookup
RegistryCredentialsProvider.cs	Updated method signature to accept RegistryAuthentication
CopyImageService.cs	Moved resource ID creation from parameters to internal lookup
CopyImagesOptions.cs	Removed subscription and resource group properties
CopyImagesCommand.cs	Simplified with primary constructor, removed subscription/resource group parameters
BuildOptions.cs	Removed subscription and resource group CLI options
BuildCommand.cs	Updated to use simplified ImportImageAsync signature
AcrContentClientFactory.cs	Updated to use new authentication lookup
AcrClientFactory.cs	Updated to use new authentication lookup
PublishConfigurationBindingTests.cs	New test file for configuration binding validation
Various test files	Updated to remove subscription/resource group setup and verification

[Copilot]

The comment refers to 'Azure DevOps service connection' but the broader context suggests this could be used with other authentication mechanisms. Consider updating the comment to be more general or clarify that Azure DevOps is just one example.

Suggested change

	/// The Azure DevOps service connection for authenticating to this registry.
	/// The service connection used for authenticating to this registry (for example, an Azure DevOps service connection).

[Copilot]

The method calls Acr.Parse(registry) to extract the registry name, but Acr.Parse() was already called earlier in FindRegistryAuthentication (line 35). Consider passing the already-parsed Acr object to avoid redundant parsing.

[Copilot]

The comment states 'same tenant' but the code logic doesn't verify tenant matching. Consider clarifying whether tenant validation happens elsewhere or if this assumption should be documented as a requirement.

Suggested change

	// imports (same tenant), or RegistryAddress for external registries.
	// imports when the source and destination registries are expected to be in the same tenant
	// (this method does not validate tenant matching), or RegistryAddress for external registries.