From 20e5df2e5bcd3ba6b1931c2490b3726b0990aa77 Mon Sep 17 00:00:00 2001 From: Sanaa Hamel Date: Fri, 3 Jul 2026 10:56:24 -0400 Subject: [PATCH 1/5] fix(ci): incorrect identity for az login --- .github/workflows/linux-cpu-arm64-build.yml | 2 +- .github/workflows/linux-gpu-x64-build.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/linux-cpu-arm64-build.yml b/.github/workflows/linux-cpu-arm64-build.yml index 764d82e426..81ea0aac02 100644 --- a/.github/workflows/linux-cpu-arm64-build.yml +++ b/.github/workflows/linux-cpu-arm64-build.yml @@ -73,7 +73,7 @@ jobs: - name: Download Docker Image run: | set -e -x - az login --identity --object-id b44538a9-6545-4353-907e-da46df88a2ab + az login --identity --object-id 161bbca8-9899-4f61-950c-4d556fbcf830 az acr login --name onnxruntimebuildcache --subscription 00c06639-6ee4-454e-8058-8d8b1703bd87 python3 tools/ci_build/get_docker_image.py --dockerfile tools/ci_build/github/linux/docker/inference/aarch64/default/cpu/Dockerfile \ --context tools/ci_build/github/linux/docker/inference/aarch64/default/cpu \ diff --git a/.github/workflows/linux-gpu-x64-build.yml b/.github/workflows/linux-gpu-x64-build.yml index 4a0dec58f0..b3a605253c 100644 --- a/.github/workflows/linux-gpu-x64-build.yml +++ b/.github/workflows/linux-gpu-x64-build.yml @@ -102,7 +102,7 @@ jobs: - name: Get Docker Image run: | set -e -x - az login --identity --object-id b44538a9-6545-4353-907e-da46df88a2ab + az login --identity --object-id 161bbca8-9899-4f61-950c-4d556fbcf830 az acr login --name onnxruntimebuildcache --subscription 00c06639-6ee4-454e-8058-8d8b1703bd87 python3 tools/ci_build/get_docker_image.py --dockerfile tools/ci_build/github/linux/docker/manylinux/Dockerfile.manylinux2_28_cuda_12.8 \ --context tools/ci_build/github/linux/docker/manylinux \ From df864d91de72b20f3b97d477e75318d049f75be6 Mon Sep 17 00:00:00 2001 From: Sanaa Hamel Date: Fri, 3 Jul 2026 11:04:47 -0400 Subject: [PATCH 2/5] chore: `.ignore` b/c I'm tired of doing `-uu` --- .ignore | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .ignore diff --git a/.ignore b/.ignore new file mode 100644 index 0000000000..a16c888bf0 --- /dev/null +++ b/.ignore @@ -0,0 +1,3 @@ +!/.config +!/.github +!/.pipelines \ No newline at end of file From f25ce925cb1ceab3e219c60b3855b9f14676b561 Mon Sep 17 00:00:00 2001 From: Sanaa Hamel Date: Mon, 6 Jul 2026 12:32:05 -0400 Subject: [PATCH 3/5] fix(ci): use GHCR instead of ACR for docker cache --- .github/workflows/linux-cpu-arm64-build.yml | 7 ++++++- .github/workflows/linux-gpu-x64-build.yml | 7 ++++++- .pipelines/stages/jobs/integration-build-job.yml | 2 +- .pipelines/stages/jobs/steps/capi-linux-step.yml | 4 ++-- tools/ci_build/get_docker_image.py | 6 ++---- 5 files changed, 17 insertions(+), 9 deletions(-) diff --git a/.github/workflows/linux-cpu-arm64-build.yml b/.github/workflows/linux-cpu-arm64-build.yml index 81ea0aac02..87b8b2fcd3 100644 --- a/.github/workflows/linux-cpu-arm64-build.yml +++ b/.github/workflows/linux-cpu-arm64-build.yml @@ -18,6 +18,9 @@ env: jobs: linux-cpu-arm64-build: + permissions: + contents: read + packages: write # needed for GHCR push runs-on: ["self-hosted", "1ES.Pool=onnxruntime-genai-Ubuntu2004-ARM-CPU"] steps: - name: Checkout OnnxRuntime GenAI repo @@ -75,10 +78,12 @@ jobs: set -e -x az login --identity --object-id 161bbca8-9899-4f61-950c-4d556fbcf830 az acr login --name onnxruntimebuildcache --subscription 00c06639-6ee4-454e-8058-8d8b1703bd87 + docker login --username "$GITHUB_ACTOR" --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io + python3 tools/ci_build/get_docker_image.py --dockerfile tools/ci_build/github/linux/docker/inference/aarch64/default/cpu/Dockerfile \ --context tools/ci_build/github/linux/docker/inference/aarch64/default/cpu \ --docker-build-args "--build-arg BUILD_UID=$( id -u )" \ - --container-registry onnxruntimebuildcache \ + --container-registry ghcr.io/microsoft/onnxruntime-genai \ --repository ort_genai_linux_arm64_gha - name: Docker -- Configure with CMake and GCC diff --git a/.github/workflows/linux-gpu-x64-build.yml b/.github/workflows/linux-gpu-x64-build.yml index b3a605253c..69af9db863 100644 --- a/.github/workflows/linux-gpu-x64-build.yml +++ b/.github/workflows/linux-gpu-x64-build.yml @@ -19,6 +19,9 @@ env: jobs: linux-cuda-x64-build: + permissions: + contents: read + packages: write # needed for GHCR push env: PYTHON_EXECUTABLE: "/opt/python/cp312-cp312/bin/python3.12" runs-on: ["self-hosted", "1ES.Pool=onnxruntime-genai-Ubuntu2204-A10"] @@ -104,10 +107,12 @@ jobs: set -e -x az login --identity --object-id 161bbca8-9899-4f61-950c-4d556fbcf830 az acr login --name onnxruntimebuildcache --subscription 00c06639-6ee4-454e-8058-8d8b1703bd87 + docker login --username "$GITHUB_ACTOR" --password '${{ secrets.GITHUB_TOKEN }}' ghcr.io + python3 tools/ci_build/get_docker_image.py --dockerfile tools/ci_build/github/linux/docker/manylinux/Dockerfile.manylinux2_28_cuda_12.8 \ --context tools/ci_build/github/linux/docker/manylinux \ --docker-build-args "--build-arg BUILD_UID=$( id -u )" \ - --container-registry onnxruntimebuildcache \ + --container-registry ghcr.io/microsoft/onnxruntime-genai \ --manylinux-src manylinux \ --multiple_repos \ --repository onnxruntimecudabuildx64 diff --git a/.pipelines/stages/jobs/integration-build-job.yml b/.pipelines/stages/jobs/integration-build-job.yml index 737491a995..78e9a80835 100644 --- a/.pipelines/stages/jobs/integration-build-job.yml +++ b/.pipelines/stages/jobs/integration-build-job.yml @@ -64,7 +64,7 @@ jobs: --dockerfile tools/ci_build/github/linux/docker/manylinux/Dockerfile.manylinux2_28_cuda_12.8 \ --context tools/ci_build/github/linux/docker/manylinux \ --docker-build-args "--build-arg BUILD_UID=$( id -u )" \ - --container-registry onnxruntimebuildcache \ + --container-registry onnxruntimebuildcache.azurecr.io \ --repository ortgenaicudabuildx64 displayName: 'Build manylinux CUDA docker image' workingDirectory: '$(Build.Repository.LocalPath)' diff --git a/.pipelines/stages/jobs/steps/capi-linux-step.yml b/.pipelines/stages/jobs/steps/capi-linux-step.yml index ce7113979a..5792b33722 100644 --- a/.pipelines/stages/jobs/steps/capi-linux-step.yml +++ b/.pipelines/stages/jobs/steps/capi-linux-step.yml @@ -59,7 +59,7 @@ steps: python3 tools/ci_build/get_docker_image.py --dockerfile tools/ci_build/github/linux/docker/manylinux/Dockerfile.manylinux2_28_$(ep)_$cuda_dockerfile_version \ --context tools/ci_build/github/linux/docker/manylinux \ --docker-build-args "--build-arg BUILD_UID=$( id -u )" \ - --container-registry onnxruntimebuildcache \ + --container-registry onnxruntimebuildcache.azurecr.io \ --repository ortgenai$(ep)build$(arch) displayName: 'Get CUDA Docker Image $(cuda_version)' condition: eq(variables['ep'], 'cuda') @@ -76,7 +76,7 @@ steps: python3 tools/ci_build/get_docker_image.py --dockerfile "$dockerfile" \ --context tools/ci_build/github/linux/docker/manylinux \ --docker-build-args "--build-arg BUILD_UID=$( id -u )" \ - --container-registry onnxruntimebuildcache \ + --container-registry onnxruntimebuildcache.azurecr.io \ --repository ortgenai$(ep)build$(arch) displayName: 'Get Docker Image' condition: ne(variables['ep'], 'cuda') diff --git a/tools/ci_build/get_docker_image.py b/tools/ci_build/get_docker_image.py index 203f13ca2b..bc5a8c9c06 100644 --- a/tools/ci_build/get_docker_image.py +++ b/tools/ci_build/get_docker_image.py @@ -34,7 +34,7 @@ def parse_args(): parser.add_argument( "--container-registry", - help="The Azure container registry name. If not provided, no container registry will be used.", + help="Container registry host and, optionally, qualifiers. If not provided, no container registry will be used.", ) parser.add_argument("--repository", required=True, help="The image repository name.") @@ -64,9 +64,7 @@ def main(): log.info("No container registry will be used") full_image_name = ( - f"{args.container_registry}.azurecr.io/{args.repository}:latest" - if use_container_registry - else f"{args.repository}:latest" + f"{args.container_registry}/{args.repository}:latest" if use_container_registry else f"{args.repository}:latest" ) log.info(f"Image: {full_image_name}") From 6ab086fcc8027be04d76c03da2c29947ab9b4fb5 Mon Sep 17 00:00:00 2001 From: Sanaa Hamel Date: Tue, 7 Jul 2026 13:41:21 -0400 Subject: [PATCH 4/5] chore: add newline to `.ignore` --- .ignore | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.ignore b/.ignore index a16c888bf0..153a6e5c03 100644 --- a/.ignore +++ b/.ignore @@ -1,3 +1,3 @@ !/.config !/.github -!/.pipelines \ No newline at end of file +!/.pipelines From 521a8ecd3a88c6411471e20e11cc3cc1ff9f7308 Mon Sep 17 00:00:00 2001 From: Sanaa Hamel Date: Tue, 7 Jul 2026 13:50:23 -0400 Subject: [PATCH 5/5] doc: description for `.ignore` --- .ignore | 3 +++ 1 file changed, 3 insertions(+) diff --git a/.ignore b/.ignore index 153a6e5c03..4ec93643d3 100644 --- a/.ignore +++ b/.ignore @@ -1,3 +1,6 @@ +# Used by various tools such as ripgrep, fd-find, etc. +# Same syntax and path semantics as `.gitignore`. + !/.config !/.github !/.pipelines