From 08cb00b8176bfcc7debf1701b15bde3028e68f7c Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 27 Aug 2026 19:07:51 +0300
Subject: [PATCH 1/2] feat: add options for uploading artifacts to Storj and
 Azure Container Registry in build workflow

---
 .github/workflows/build-sp-vm.yml | 45 ++++++++++++++++++++++++++++++-
 1 file changed, 44 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/build-sp-vm.yml b/.github/workflows/build-sp-vm.yml
index 6d488b66..c1fd58ac 100644
--- a/.github/workflows/build-sp-vm.yml
+++ b/.github/workflows/build-sp-vm.yml
@@ -17,11 +17,21 @@ on:
         options:
           - debug
           - release
+      upload-to-storj:
+        required: false
+        type: boolean
+        default: true
+        description: Upload image artifacts to Storj
       upload-to-gcp:
         required: false
         type: boolean
         default: false
         description: Upload image to GCP bucket and create compute image
+      upload-to-azurecr:
+        required: false
+        type: boolean
+        default: false
+        description: Push image artifacts to Azure Container Registry
 jobs:
   build-asset:
     runs-on: ${{ inputs.runs-on }}
@@ -96,6 +106,7 @@ jobs:
               --build-arg "S3_BUCKET=$S3_BUCKET";
 
       - name: Upload files to Storj
+        if: ${{ inputs.upload-to-storj }}
         working-directory: out
         run: |
           function upload_file() {
@@ -104,7 +115,7 @@ jobs:
                   echo "File $FILE not found";
                   exit 1;
               fi
-              echo "Uploading $file to ${S3_BUCKET}/${SP_VM_IMAGE_VERSION}/"
+              echo "Uploading $FILE to ${S3_BUCKET}/${SP_VM_IMAGE_VERSION}/"
               rclone copy \
                   --multi-thread-streams 8 \
                   --s3-provider Storj \
@@ -177,6 +188,38 @@ jobs:
           echo "==> Cleaning up temporary GCS object"
           gsutil rm "${SOURCE_URI}"
 
+      - name: Log in to Azure
+        if: ${{ inputs.upload-to-azurecr }}
+        uses: azure/login@v2
+        with:
+          creds: ${{ secrets.AZURE_CREDENTIALS }}
+
+      - name: Push image to Azure Container Registry
+        if: ${{ inputs.upload-to-azurecr }}
+        working-directory: out
+        env:
+          AZURE_CONTAINER_REGISTRY: ${{ secrets.AZURE_CONTAINER_REGISTRY }}
+        run: |
+          if [[ -z "${AZURE_CONTAINER_REGISTRY}" ]]; then
+            echo "Secret AZURE_CONTAINER_REGISTRY is not set" >&2
+            exit 1
+          fi
+
+          ACR_NAME="${AZURE_CONTAINER_REGISTRY%.azurecr.io}"
+          LOGIN_SERVER="${ACR_NAME}.azurecr.io"
+          IMAGE="${LOGIN_SERVER}/sp-vm:${SP_VM_IMAGE_VERSION}"
+
+          echo "==> Logging in to ACR ${LOGIN_SERVER}"
+          az acr login --name "${ACR_NAME}"
+
+          echo "==> Building OCI image ${IMAGE} from local artifacts"
+          printf '%s\n' 'FROM scratch' 'COPY . /' > Dockerfile.acr
+          docker build -t "${IMAGE}" -f Dockerfile.acr .
+          rm -f Dockerfile.acr
+
+          echo "==> Pushing ${IMAGE}"
+          docker push "${IMAGE}"
+
       - name: Create Release
         uses: softprops/action-gh-release@v2
         with:

From c6e272b208aa349addbf44a648030e105ffd2b3a Mon Sep 17 00:00:00 2001
From: Lex Kheben <i@zbit.name>
Date: Thu, 27 Aug 2026 19:28:26 +0300
Subject: [PATCH 2/2] fix: improve Azure login process in build workflow by
 validating credentials and using Docker login

---
 .github/workflows/build-sp-vm.yml | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/build-sp-vm.yml b/.github/workflows/build-sp-vm.yml
index c1fd58ac..e510c244 100644
--- a/.github/workflows/build-sp-vm.yml
+++ b/.github/workflows/build-sp-vm.yml
@@ -188,29 +188,37 @@ jobs:
           echo "==> Cleaning up temporary GCS object"
           gsutil rm "${SOURCE_URI}"
 
-      - name: Log in to Azure
-        if: ${{ inputs.upload-to-azurecr }}
-        uses: azure/login@v2
-        with:
-          creds: ${{ secrets.AZURE_CREDENTIALS }}
-
       - name: Push image to Azure Container Registry
         if: ${{ inputs.upload-to-azurecr }}
         working-directory: out
         env:
+          AZURE_CREDENTIALS: ${{ secrets.AZURE_CREDENTIALS }}
           AZURE_CONTAINER_REGISTRY: ${{ secrets.AZURE_CONTAINER_REGISTRY }}
         run: |
           if [[ -z "${AZURE_CONTAINER_REGISTRY}" ]]; then
             echo "Secret AZURE_CONTAINER_REGISTRY is not set" >&2
             exit 1
           fi
+          if [[ -z "${AZURE_CREDENTIALS}" ]]; then
+            echo "Secret AZURE_CREDENTIALS is not set" >&2
+            exit 1
+          fi
 
           ACR_NAME="${AZURE_CONTAINER_REGISTRY%.azurecr.io}"
           LOGIN_SERVER="${ACR_NAME}.azurecr.io"
           IMAGE="${LOGIN_SERVER}/sp-vm:${SP_VM_IMAGE_VERSION}"
 
+          CLIENT_ID="$(echo "${AZURE_CREDENTIALS}" | jq -r '.clientId // .appId // empty')"
+          CLIENT_SECRET="$(echo "${AZURE_CREDENTIALS}" | jq -r '.clientSecret // .password // empty')"
+          if [[ -z "${CLIENT_ID}" || -z "${CLIENT_SECRET}" ]]; then
+            echo "AZURE_CREDENTIALS must contain clientId and clientSecret" >&2
+            exit 1
+          fi
+
           echo "==> Logging in to ACR ${LOGIN_SERVER}"
-          az acr login --name "${ACR_NAME}"
+          echo "${CLIENT_SECRET}" | docker login "${LOGIN_SERVER}" \
+            --username "${CLIENT_ID}" \
+            --password-stdin
 
           echo "==> Building OCI image ${IMAGE} from local artifacts"
           printf '%s\n' 'FROM scratch' 'COPY . /' > Dockerfile.acr