Merge branch 'main' into dependabot/go_modules/go-dependencies-07f835f864

Author: sk593

.github/workflows/functional-test-noncloud.yaml

@@ -87,6 +87,9 @@ env:
   GIT_HTTP_PASSWORD: not-a-secret-password
   # Kubernetes client QPS and Burst settings for high-concurrency CI environments
   RADIUS_QPS_AND_BURST: "800"
+  # Bicep CLI pinned: v0.40+ rejects br:localhost:5000/... (ThrowIfRegistryNotTrusted).
+  # Bump only after verifying localhost support or adding allowedUntrustedRegistries to bicepconfig.json.
+  BICEP_VER: v0.42.1
 
 jobs:
   changes:
@@ -248,6 +251,13 @@ jobs:
           registry-server: ${{ env.LOCAL_REGISTRY_SERVER }}
           registry-port: ${{ env.LOCAL_REGISTRY_PORT }}
 
+      - name: Setup and verify bicep CLI
+        run: |
+          curl -Lo bicep "https://github.com/Azure/bicep/releases/download/${{ env.BICEP_VER }}/bicep-linux-x64"
+          chmod +x ./bicep
+          sudo mv ./bicep /usr/local/bin/bicep
+          bicep --version
+
       - name: Publish bicep types
         run: |
           bicep publish-extension ./hack/bicep-types-radius/generated/index.json --target br:${{ env.LOCAL_REGISTRY_SERVER }}:${{ env.LOCAL_REGISTRY_PORT }}/radius:${{ env.REL_VERSION == 'edge' && 'latest' || env.REL_VERSION }} --force
@@ -428,13 +438,6 @@ jobs:
         run: |
           make publish-test-terraform-recipes
 
-      - name: Setup and verify bicep CLI
-        run: |
-          curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
-          chmod +x ./bicep
-          sudo mv ./bicep /usr/local/bin/bicep
-          bicep --version
-
       - name: Publish bicep types
         run: |
           bicep publish-extension ./hack/bicep-types-radius/generated/index.json --target br:${{ env.LOCAL_REGISTRY_SERVER }}:${{ env.LOCAL_REGISTRY_PORT }}/radius:${{ env.REL_VERSION == 'edge' && 'latest' || env.REL_VERSION }} --force

.github/workflows/validate-bicep.yaml

@@ -33,6 +33,9 @@ env:
   LOCAL_REGISTRY_SERVER: localhost
   # Local Docker registry port
   LOCAL_REGISTRY_PORT: "5000"
+  # Bicep CLI pinned: v0.43+ rejects br:localhost:5000/... (ThrowIfRegistryNotTrusted).
+  # Bump only after verifying localhost support or adding allowedUntrustedRegistries to bicepconfig.json.
+  BICEP_VER: v0.42.1
 
 concurrency:
   # Cancel the previously triggered build for only PR build.
@@ -72,7 +75,7 @@ jobs:
       - name: Setup and verify bicep CLI
         run: |
           # Download bicep CLI
-          curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-x64
+          curl -Lo bicep "https://github.com/Azure/bicep/releases/download/${{ env.BICEP_VER }}/bicep-linux-x64"
           chmod +x ./bicep
 
           # Install in both locations for maximum compatibility

build/install-bicep.sh

@@ -59,12 +59,17 @@ if [ "$ARCH" = "arm64" ]; then
   BICEP_ARCH="arm64"
 fi
 
+# Bicep CLI version. Pinned because Bicep v0.43+ tightened
+# ContainerRegistryClientFactory.ThrowIfRegistryNotTrusted to reject br:localhost:5000/... targets,
+# breaking publish-extension to local registries used by our CI and local dev workflows.
+BICEP_VER="v0.42.1"
+
 # Check if bicep binary already exists in the target location
 if [ -f "$OUTPUT_DIR/bicep" ]; then
   echo "Bicep CLI already exists at $OUTPUT_DIR/bicep, skipping download."
 else
-  echo "Downloading Bicep CLI..."
-  if ! curl -Lo bicep https://github.com/Azure/bicep/releases/latest/download/bicep-linux-$BICEP_ARCH; then
+  echo "Downloading Bicep CLI ${BICEP_VER}..."
+  if ! curl -Lo bicep "https://github.com/Azure/bicep/releases/download/${BICEP_VER}/bicep-linux-${BICEP_ARCH}"; then
     echo "Failed to download Bicep CLI. Please check your internet connection or the URL."
     exit 1
   fi

pkg/cli/bicep/tools/download_tools.go

@@ -28,8 +28,14 @@ import (
 )
 
 const (
+	// bicepVersion is the pinned version of the Bicep CLI to download.
+	// Pinned because Bicep v0.43+ tightened ContainerRegistryClientFactory.ThrowIfRegistryNotTrusted
+	// to reject br:localhost:5000/... targets, breaking publish-extension to local registries used
+	// by our CI and local dev workflows.
+	bicepVersion = "v0.42.1"
+
 	// binaryRepo is the name of the remote bicep binary repository
-	binaryRepo = "https://github.com/Azure/bicep/releases/latest/download/"
+	binaryRepo = "https://github.com/Azure/bicep/releases/download/" + bicepVersion + "/"
 )
 
 // validPlatforms is a map of valid platforms to download for. The key is the combination of GOOS and GOARCH.