radius-project · sylvainsf · May 14, 2026 · May 19, 2026 · May 19, 2026 · May 19, 2026
@@ -18,7 +18,7 @@
       "minikube": "none",
       "helm": "3.19.4"
     },
-    "ghcr.io/devcontainers/features/docker-in-docker:3.0.0": {
+    "ghcr.io/devcontainers/features/docker-in-docker:3.0.1": {
       "version": "latest",
       "moby": true
     },

@@ -11,7 +11,7 @@ runs:
   using: composite
   steps:
     - name: Install Flux CLI
-      uses: fluxcd/flux2/action@54e4ba378e155ada619caafdc599e5c4d759ce5c # v2.8.7
+      uses: fluxcd/flux2/action@1fd61a06264d71cf445ed55c4f14d401d26a1c64 # v2.8.8
       with:
         version: ${{ inputs.version }}
 

@@ -65,5 +65,9 @@ for RECIPE in $(find "$DIRECTORY" -type f -name "*.bicep"); do
 
     echo "Publishing $RECIPE to $PUBLISH_REF"
     echo "- $PUBLISH_REF" >>$GITHUB_STEP_SUMMARY
-    rad bicep publish --file $RECIPE --target "br:$PUBLISH_REF"
+    PUBLISH_FLAGS=()
+    if [[ "${PLAIN_HTTP:-false}" == "true" ]]; then
+        PUBLISH_FLAGS+=(--plain-http)
+    fi
+    rad bicep publish --file "$RECIPE" --target "br:$PUBLISH_REF" "${PUBLISH_FLAGS[@]}"
 done
@@ -20,7 +20,7 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/stale@b5d41d4e1d5dceea10e7104786b73624c18a190f # v10.2.0
+      - uses: actions/stale@eb5cf3af3ac0a1aa4c9c45633dd1ae542a27a899 # v10.3.0
         with:
           repo-token: ${{ github.token }}
           stale-pr-message: |

@@ -100,15 +100,15 @@ jobs:
 
       - name: Initialize CodeQL
         if: ${{ !startsWith(matrix.language, 'custom-') }}
-        uses: github/codeql-action/init@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/init@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           config-file: .github/configs/.codeql.yml
           languages: ${{ matrix.language }}
           build-mode: ${{ matrix.build-mode }}
 
       - name: Auto build
         if: matrix.build-mode == 'autobuild'
-        uses: github/codeql-action/autobuild@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/autobuild@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           working-directory: ${{ matrix.working-directory }}
 
@@ -127,14 +127,14 @@ jobs:
 
       - name: Upload GoSec result
         if: ${{ always() && matrix.language == 'custom-gosec' }}
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           sarif_file: gosec-results.sarif
           wait-for-processing: true
 
       - name: Perform CodeQL Analysis
         if: ${{ !startsWith(matrix.language, 'custom-') }}
-        uses: github/codeql-action/analyze@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/analyze@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         id: codeql-analyze
         with:
           category: /language:${{matrix.language}}
@@ -143,7 +143,7 @@ jobs:
 
       - name: Upload CodeQL result
         if: ${{ always() && !startsWith(matrix.language, 'custom-') }}
-        uses: github/codeql-action/upload-sarif@68bde559dea0fdcac2102bfdf6230c5f70eb485e # v4.35.4
+        uses: github/codeql-action/upload-sarif@9e0d7b8d25671d64c341c19c0152d693099fb5ba # v4.35.5
         with:
           sarif_file: ${{ format('{0}/{1}.sarif', steps.codeql-analyze.outputs.sarif-output, matrix.language) }}
           wait-for-processing: true

@@ -0,0 +1,226 @@
+# ------------------------------------------------------------
+# Copyright 2026 The Radius Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# ------------------------------------------------------------
+
+# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
+---
+name: contrib-update-resource-types
+
+# Triggered via `repository_dispatch` from radius-project/resource-types-contrib
+# whenever its `main` branch updates. Opens (or refreshes) a PR that runs
+# `make update-resource-types` so the manifest copies committed under
+# deploy/manifest/built-in-providers/ stay in sync with the contrib repo.
+#
+# Merging the resulting PR triggers the existing `build-and-push-bicep-types`
+# job in build.yaml, which dispatches to azure-octo/radius-publisher to
+# republish `radius:latest` with the refreshed contrib types.
+#
+# See the design note:
+#   eng/design-notes/extensibility/2026-05-unified-bicep-extension-publishing.md
+
+on:
+  repository_dispatch:
+    types:
+      - resource-types-contrib-updated
+  # workflow_dispatch: # Enable during development for manual testing
+  #   inputs:
+  #     contrib_ref:
+  #       description: "Optional resource-types-contrib commit SHA the update is based on."
+  #       required: false
+  #       default: ""
+
+permissions: {}
+
+concurrency:
+  # Only one in-flight refresh PR at a time.
+  group: contrib-update-resource-types
+  cancel-in-progress: false
+
+env:
+  PR_BRANCH: bot/update-resource-types
+  CONTRIB_REPO: radius-project/resource-types-contrib
+  YQ_VERSION: v4.44.3
+  YQ_LINUX_AMD64_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
+
+jobs:
+  open-update-pr:
+    name: Open update-resource-types PR
+    if: github.repository == 'radius-project/radius'
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    permissions:
+      contents: read # actions/checkout
+    steps:
+      - name: Resolve contrib ref
+        # Extracts the contrib commit SHA from either the dispatch payload or
+        # workflow_dispatch input. Validates it as a hex SHA to prevent injection.
+        # Falls back to "main" if not provided. Note: this value is informational
+        # only (used in commit messages and PR body). The actual version fetched
+        # is determined by 'make update-resource-types' which runs 'go get ...@latest'.
+        id: contrib
+        env:
+          DISPATCH_REF: ${{ github.event.client_payload.contrib_ref }}
+          INPUT_REF: ${{ github.event.inputs.contrib_ref }}
+        run: |
+          set -euo pipefail
+          ref="${DISPATCH_REF:-${INPUT_REF:-}}"
+          if [ -z "${ref}" ]; then
+            ref="main"
+          elif ! [[ "${ref}" =~ ^[a-f0-9]{7,40}$ ]]; then
+            echo "ERROR: contrib_ref must be a hex commit SHA, got '${ref}'"
+            exit 1
+          fi
+          echo "ref=${ref}" >> "${GITHUB_OUTPUT}"
+          echo "Contrib ref: ${ref}"
+
+      - name: Generate App Token
+        # Uses a GitHub App token instead of the default GITHUB_TOKEN so that
+        # the bot can push the PR branch and the resulting PR triggers CI checks.
+        # The default GITHUB_TOKEN cannot trigger workflows on pushes it creates.
+        id: app-token
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        with:
+          client-id: ${{ vars.RESOURCE_TYPES_BOT_CLIENT_ID }}
+          private-key: ${{ secrets.RESOURCE_TYPES_BOT_PRIVATE_KEY }}
+          owner: ${{ github.repository_owner }}
+          repositories: |
+            radius
+          permission-metadata: read
+          permission-contents: write
+          permission-pull-requests: write
+
+      - name: Checkout
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          persist-credentials: true
+
+      - name: Set up Git identity
+        # Configure git author for the automated commit on the PR branch.
+        run: |
+          git config user.name "Radius CI Bot"
+          git config user.email "radiuscoreteam@service.microsoft.com"
+
+      - name: Setup Go
+        uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6.4.0
+        with:
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+          cache: true
+
+      - name: Install yq
+        # Required by make update-resource-types / sync-resource-types to parse
+        # deploy/manifest/defaults.yaml.
+        run: |
+          mkdir -p "${RUNNER_TEMP}/bin"
+          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o "${RUNNER_TEMP}/bin/yq"
+          echo "${YQ_LINUX_AMD64_SHA256}  ${RUNNER_TEMP}/bin/yq" | sha256sum -c -
+          chmod +x "${RUNNER_TEMP}/bin/yq"
+          echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
+
+      - name: Run make update-resource-types
+        # Bumps go.mod to the latest resource-types-contrib version and copies
+        # the manifest files listed in defaults.yaml into
+        # deploy/manifest/built-in-providers/{dev,self-hosted}/.
+        run: |
+          set -euo pipefail
+          if ! make -n update-resource-types >/dev/null 2>&1; then
+            echo "ERROR: 'make update-resource-types' target is not yet defined." >&2
+            echo "This workflow depends on the target introduced by the default-registration design" >&2
+            echo "(eng/design-notes/extensibility/2026-04-automated-default-resource-type-registration.md)." >&2
+            exit 1
+          fi
+          make update-resource-types
+
+      - name: Detect changes
+        # Uses git status --porcelain (not git diff --quiet) because
+        # make update-resource-types may create new untracked files when new
+        # resource types are added to defaults.yaml. git diff only detects
+        # modifications to already-tracked files.
+        id: changes
+        run: |
+          set -euo pipefail
+          if [ -z "$(git status --porcelain)" ]; then
+            echo "changed=false" >> "${GITHUB_OUTPUT}"
+            echo "No changes from 'make update-resource-types'; nothing to do."
+          else
+            echo "changed=true" >> "${GITHUB_OUTPUT}"
+          fi
+
+      - name: Create or update PR branch
+        # Force-pushes to the bot branch so that if a previous automated PR is
+        # still open, its content is replaced with the latest manifests rather
+        # than accumulating stale commits.
+        if: steps.changes.outputs.changed == 'true'
+        env:
+          CONTRIB_REF: ${{ steps.contrib.outputs.ref }}
+        run: |
+          set -euo pipefail
+          git checkout -B "${PR_BRANCH}"
+          git add -A
+          git commit -m "chore: refresh resource type manifests from ${CONTRIB_REPO} (${CONTRIB_REF})"
+          git push --force origin "${PR_BRANCH}"
+
+      - name: Open or update pull request
+        # Creates a new PR if none exists for the bot branch, or updates the
+        # existing one's title and body. Uses github-script because we need
+        # conditional create-or-update logic that gh pr create doesn't support.
+        if: steps.changes.outputs.changed == 'true'
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          CONTRIB_REF: ${{ steps.contrib.outputs.ref }}
+        with:
+          github-token: ${{ steps.app-token.outputs.token }}
+          script: |
+            const branch = process.env.PR_BRANCH;
+            const contribRef = process.env.CONTRIB_REF;
+            const title = "chore: refresh resource type manifests from resource-types-contrib";
+            const body = [
+              "Automated refresh of resource type manifests under `deploy/manifest/built-in-providers/`.",
+              "",
+              `Triggered by an update to [\`${process.env.CONTRIB_REPO}\`](https://github.com/${process.env.CONTRIB_REPO}) at ref \`${contribRef}\`.`,
+              "",
+              "Merging this PR will republish `br:biceptypes.azurecr.io/radius:latest` via the existing `build-and-push-bicep-types` job in `build.yaml`.",
+            ].join("\n");
+
+            const { owner, repo } = context.repo;
+            const { data: existing } = await github.rest.pulls.list({
+              owner,
+              repo,
+              head: `${owner}:${branch}`,
+              state: "open",
+            });
+
+            if (existing.length === 0) {
+              const { data: pr } = await github.rest.pulls.create({
+                owner,
+                repo,
+                title,
+                head: branch,
+                base: "main",
+                body,
+              });
+              core.notice(`Opened PR #${pr.number}: ${pr.html_url}`);
+            } else {
+              const pr = existing[0];
+              await github.rest.pulls.update({
+                owner,
+                repo,
+                pull_number: pr.number,
+                title,
+                body,
+              });
+              core.notice(`Refreshed existing PR #${pr.number}: ${pr.html_url}`);
+            }
@@ -53,6 +53,7 @@ env:
   GOTESTSUM_VER: 1.13.0
   # yq version
   YQ_VERSION: v4.44.3
+  YQ_LINUX_AMD64_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
   # Helm version
   HELM_VER: v3.19.4
   # KinD cluster version
@@ -452,7 +453,9 @@ jobs:
         # Required by make generate-bicep-types-contrib to parse defaults.yaml.
         run: |
           mkdir -p "${RUNNER_TEMP}/bin"
-          GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@${{ env.YQ_VERSION }}
+          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o "${RUNNER_TEMP}/bin/yq"
+          echo "${YQ_LINUX_AMD64_SHA256}  ${RUNNER_TEMP}/bin/yq" | sha256sum -c -
+          chmod +x "${RUNNER_TEMP}/bin/yq"
           echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
 
       - name: Generate Bicep extensibility types from OpenAPI specs

@@ -49,6 +49,7 @@ env:
   GOTESTSUM_VER: 1.13.0
   # yq version
   YQ_VERSION: v4.44.3
+  YQ_LINUX_AMD64_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
   # Helm version
   HELM_VER: v3.19.4
   # KinD cluster version
@@ -243,7 +244,9 @@ jobs:
         # Required by make generate-bicep-types-contrib to parse defaults.yaml.
         run: |
           mkdir -p "${RUNNER_TEMP}/bin"
-          GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@${{ env.YQ_VERSION }}
+          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o "${RUNNER_TEMP}/bin/yq"
+          echo "${YQ_LINUX_AMD64_SHA256}  ${RUNNER_TEMP}/bin/yq" | sha256sum -c -
+          chmod +x "${RUNNER_TEMP}/bin/yq"
           echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
 
       - name: Generate Bicep extensibility types from OpenAPI specs

@@ -32,6 +32,7 @@ concurrency:
 
 env:
   YQ_VERSION: v4.44.3
+  YQ_LINUX_AMD64_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
 
 permissions: {}
 
@@ -82,7 +83,9 @@ jobs:
         # Required by make generate-bicep-types-contrib to parse defaults.yaml.
         run: |
           mkdir -p "${RUNNER_TEMP}/bin"
-          GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@${{ env.YQ_VERSION }}
+          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o "${RUNNER_TEMP}/bin/yq"
+          echo "${YQ_LINUX_AMD64_SHA256}  ${RUNNER_TEMP}/bin/yq" | sha256sum -c -
+          chmod +x "${RUNNER_TEMP}/bin/yq"
           echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
 
       - name: Install helm

@@ -26,6 +26,7 @@ permissions: {}
 
 env:
   YQ_VERSION: v4.44.3
+  YQ_LINUX_AMD64_SHA256: a2c097180dd884a8d50c956ee16a9cec070f30a7947cf4ebf87d5f36213e9ed7
 
 jobs:
   changes:
@@ -105,7 +106,9 @@ jobs:
         # Required by make generate-bicep-types-contrib to parse defaults.yaml.
         run: |
           mkdir -p "${RUNNER_TEMP}/bin"
-          GOBIN="${RUNNER_TEMP}/bin" go install github.com/mikefarah/yq/v4@${{ env.YQ_VERSION }}
+          curl -fsSL "https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64" -o "${RUNNER_TEMP}/bin/yq"
+          echo "${YQ_LINUX_AMD64_SHA256}  ${RUNNER_TEMP}/bin/yq" | sha256sum -c -
+          chmod +x "${RUNNER_TEMP}/bin/yq"
           echo "${RUNNER_TEMP}/bin" >> "${GITHUB_PATH}"
 
       # Generate Bicep docs