chore: publish only the Arc chart from the MCR workflow

[Yoo Bin Shin (nibooy)]

Description

Agent images are now built and published to MCR by a separate pipeline, with tags of the form <release tag>-<revision> (e.g. v0.18.16-1). This removes the image-building responsibility from build-publish-mcr.yml, leaving it to resolve the already-published tags and package the Arc member cluster agents Helm chart.

Workflow — dropped publish-images-amd64, publish-images-arm64 and create-image-manifest-bundle, leaving a single publish-arc-helm-chart job.

Tags are resolved from the public MCR registry API (/v2/<repo>/tags/list) by selecting the highest revision for a release tag:

• RELEASE_TAG — from aks/v2/fleet/member-agent, based on the latest Azure/fleet tag (or the releaseTag input)
• FLEET_NETWORKING_VERSION — from aks/v2/fleet/mcs-controller-manager, based on the latest Azure/fleet-networking tag (or the new fleetNetworkingReleaseTag input)

The member agent, refresh token and CRD installer share a revision, as do the two networking images, so one lookup per family is sufficient. A missing image now fails the run with the available tags listed, rather than producing a chart that points at a nonexistent tag. Checkout uses the plain release tag, since the revision suffix has no corresponding git tag.

Chart — repointed to the mcr.microsoft.com/aks/v2/fleet repository path where the new pipeline publishes, with the test fixtures kept in sync. Added a README covering the publishing flow and the values whose behavior does not match their names. Added *_test.go to .helmignore, which was shipping charts_test.go inside the published chart.

Verification

Dry-ran the prepare-variables script against live MCR:

release_tag=v0.18.16-1
git_ref=v0.18.16
fleet_networking_version=v0.3.44-2
arc_helmchart_version=0.18.16-1

Packaged the chart with those values and confirmed all five rendered image references return HTTP 200 from MCR:

mcr.microsoft.com/aks/v2/fleet/member-agent:v0.18.16-1
mcr.microsoft.com/aks/v2/fleet/refresh-token:v0.18.16-1
mcr.microsoft.com/aks/v2/fleet/crd-installer:v0.18.16-1
mcr.microsoft.com/aks/v2/fleet/mcs-controller-manager:v0.3.44-2
mcr.microsoft.com/aks/v2/fleet/member-net-controller-manager:v0.3.44-2

actionlint and go test ./charts/member-agent-arc/... both pass.

Notes for reviewers

• The chart version 0.18.16-1 is a semver pre-release of 0.18.16. This is safe for the Arc consumer: ClusterConfigDP persists only major/minor/patch and orders by c.MajorVersion desc, c.MinorVersion desc, c.PatchVersion desc, c._ts desc, so the revision sorts equal to the base tag and ties break on write time. It would not be safe for helm search/helm install, which skip pre-releases without --devel.
• Image tags are resolved from the MCR registry API rather than the MCR status portal; the portal is an AAD-authenticated SPA and cannot be queried from CI.

🤖 Generated with Claude Code