ci: replace auto_acr_deploy with explicit copy_to_acr steps (#7486)

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

.github/actions/build-flavor/action.yml

@@ -87,10 +87,6 @@ inputs:
     description: 'Additional Docker build args (newline-separated KEY=VALUE pairs) forwarded to docker-remote-build'
     required: false
     default: ''
-  auto_acr_deploy:
-    description: 'Also push the image directly to ACR using the same tag (mirrors copy-to-acr behavior)'
-    required: false
-    default: 'false'
 outputs:
   target_tag_plain:
     description: 'Target tag (without registry prefix)'
@@ -98,6 +94,9 @@ outputs:
   test_tag_plain:
     description: 'Test tag (without registry prefix)'
     value: ${{ steps.calculate-target-tag.outputs.test_tag_plain }}
+  cuda_version_plain:
+    description: 'CUDA major version (e.g., 12 from 12.9)'
+    value: ${{ steps.calculate-target-tag.outputs.cuda_version_plain }}
 
 runs:
   using: "composite"
@@ -154,9 +153,6 @@ runs:
             fi
           done <<< "$EXTRA_TAGS"
         fi
-        if [ "${{ inputs.auto_acr_deploy }}" == "true" ]; then
-          RESULT+="${ACR_REGISTRY}/ai-dynamo/dynamo:${{ steps.calculate-target-tag.outputs.target_tag_plain }}-cuda${CUDA_VERSION_MAJOR}-${{ inputs.platform }}"$'\n'
-        fi
         if [ "${{ inputs.build_only }}" == "true" ]; then
           if [ -z "${{ inputs.sanitized_ref_name }}" ]; then
             echo "::warning::sanitized_ref_name is empty but build_only is true; skipping branch tags"

.github/workflows/build-flavor-matrix.yml

@@ -66,11 +66,16 @@ on:
         required: false
         type: boolean
         default: false
-      auto_acr_deploy:
-        description: 'Also push the image directly to ACR using the same tag (mirrors copy-to-acr behavior)'
+      copy_to_acr:
+        description: 'Copy the built image from ECR to ACR using skopeo after the build'
         required: false
         type: boolean
         default: false
+      copy_timeout_minutes:
+        description: 'Timeout in minutes for the copy to ACR step'
+        required: false
+        type: number
+        default: 10
     secrets:
       AWS_DEFAULT_REGION:
         required: true
@@ -107,6 +112,7 @@ jobs:
         with:
           lfs: true
       - name: Build
+        id: build
         uses: ./.github/actions/build-flavor
         with:
           framework: ${{ inputs.framework }}
@@ -131,7 +137,6 @@ jobs:
           sanitized_ref_name: ${{ inputs.sanitized_ref_name }}
           build_only: ${{ inputs.build_only }}
           show_summary: ${{ inputs.push_image }}
-          auto_acr_deploy: ${{ inputs.auto_acr_deploy }}
       - name: Refresh BuildKit builder
         if: ${{ inputs.target != 'dev' }}
         uses: ./.github/actions/builder-refresher
@@ -140,6 +145,22 @@ jobs:
           flavor: ${{ inputs.framework }}
           arch: ${{ matrix.platform }}
           cuda_version: ${{ matrix.cuda_version }}
+      - name: Copy image to ACR
+        if: inputs.copy_to_acr
+        timeout-minutes: ${{ inputs.copy_timeout_minutes }}
+        uses: ./.github/actions/skopeo-copy
+        with:
+          source_registry: ${{ secrets.AWS_ACCOUNT_ID }}.dkr.ecr.${{ secrets.AWS_DEFAULT_REGION }}.amazonaws.com
+          source_image: ai-dynamo/dynamo
+          source_tag: ${{ steps.build.outputs.target_tag_plain }}-cuda${{ steps.build.outputs.cuda_version_plain }}-${{ matrix.platform }}
+          target_registry: ${{ secrets.AZURE_ACR_HOSTNAME }}
+          target_image: ai-dynamo/dynamo
+          target_tag: ${{ steps.build.outputs.target_tag_plain }}-cuda${{ steps.build.outputs.cuda_version_plain }}-${{ matrix.platform }}
+          source_aws_default_region: ${{ secrets.AWS_DEFAULT_REGION }}
+          source_aws_account_id: ${{ secrets.AWS_ACCOUNT_ID }}
+          target_azure_acr_hostname: ${{ secrets.AZURE_ACR_HOSTNAME }}
+          target_azure_acr_user: ${{ secrets.AZURE_ACR_USER }}
+          target_azure_acr_password: ${{ secrets.AZURE_ACR_PASSWORD }}
       - name: Calculate compliance image URI
         id: compliance-image
         if: inputs.run_compliance_scan

.github/workflows/post-merge-ci.yml

@@ -106,7 +106,7 @@ jobs:
       build_timeout_minutes: 60
       push_image: true
       run_compliance_scan: true
-      auto_acr_deploy: true
+      copy_to_acr: true
     secrets: inherit
 
   sglang-dev-pipeline:
@@ -121,7 +121,7 @@ jobs:
       build_timeout_minutes: 60
       push_image: true
       run_compliance_scan: true
-      auto_acr_deploy: true
+      copy_to_acr: true
     secrets: inherit
 
   trtllm-dev-pipeline:
@@ -136,7 +136,7 @@ jobs:
       build_timeout_minutes: 60
       push_image: true
       run_compliance_scan: true
-      auto_acr_deploy: true
+      copy_to_acr: true
     secrets: inherit
 
   # ============================================================================