[willdavsmith]

Summary

R4 migrates active Radius-repository production extension defaults to ghcr.io/radius-project/bicep-types-radius and ghcr.io/radius-project/bicep-types-aws, with explicit experimentalFeaturesEnabled.ociEnabled=true. Development uses GHCR edge; channels, full versions/RCs and existing user configs/digest pins retain their meaning.

October 29 refresh: R3 base #13178 is 3fb1b25dcb2e4ae4ae87bb5d2ebc456551540aa0, on pinned main 51a32aaea53cde89caae479340c7b45e666bb321. R4 head is 1f7982182dcd8bd92fafef905532b089def51c01. All four owned commits replayed conflict-free with = range-diff correspondence; aggregate stable patch ID is unchanged: 6bd553115e603716ed0aed7d84af8dedb753217a. No compatibility commit or later-main chase was needed. Native stack 13154, its order, draft status and this PR's R3 base remain unchanged.

New upstream edge/latest policy is preserved: noncloud DE_TAG stays edge; trusted cloud context defaults DE to edge and retains explicit dispatch tags. DE/dashboard main images use edge and newest-stable aliases use latest. GHCR Bicep follows the same edge/development and latest/stable split, while legacy ACR Bicep latest remains development. Stable image/Helm/bridge/channel alias promotion and no-downgrade checks are unchanged.

Other retained invariants: current O_EXCL shared CLI config writer; existing-config preservation; exact 0.62 channel/full/RC coverage; optional approved BICEP_RELEASE_PLAN path with full BICEP_EXTENSION_TAG; both legacy ACR and GHCR stable/RC configs; unknown-selector rejection; strict isolated release-attestation job/gates/read permissions/summary/verification; sibling/source/evidence checks; bounded visibility recovery; Helm isolation/retry; new Bash authorization/Terraform helpers; current pins. Deleted agents and old CLI application/defaults files remain deleted.

Only general defaults migrate. Tagged image configs remain plan-derived: ghcr-v1 selects GHCR full refs/OCI, selector-free legacy plans select ACR full refs. CI Bicep targets use the existing radius-registry TLS alias and a narrow secure-Kind DNS step; Docker/ORAS capture retains localhost.

Reason for change

Planned public-GHCR consumer migration, refreshed against the authorized upstream stable/development policy. No issue is automatically closed.

Latest hosted evidence and remaining gates

The prior pushed head's Lint, unit tests and build checks succeeded, confirming the earlier pinned-Prettier repair. The remaining failed consumers still show package availability failures, not a new demonstrated runtime defect:

Evidence	Failure
Noncloud run 40596017538	All 18 legs fail recipe compilation restoring canonical AWS edge: BCP192 / token 403 Forbidden.
Cloud run 40596013535	Both legs fail Install Radius: legacy-test-environment.bicep cannot restore canonical Radius edge, BCP192 / manifest unknown.
Bicep run 40596017636	Canonical AWS edge restore fails BCP192 / 403 Forbidden.
October 29 anonymous checks	Both canonical package pull-token endpoints still return 403.

Keep draft until ordered Radius layers and actual AWS companion deployment are complete; separately authorized private receiver guards/drains and promotion handoffs are complete; both packages are public with required edge/channel/full-version/RC refs and exact historical-digest backfill; a CLI release ships these generated defaults. Do not invent a future release version or historical provenance.

ACR resources, compatibility mirrors, historical verification/parity evidence, approved legacy image configs and private TEST_BICEP_TYPES_REGISTRY/test/radius/testresources remain. No fallback, disabled tests, live publishing/bootstrap, visibility/credentials/settings/cloud mutation, other-branch changes, stack mutation, ready/merge or auto-merge was performed.

How to test

Prerequisites: repository Go toolchain, Node.js, Bash, jq, yq, OpenSSL, Helm, Bicep/ORAS and linters. On macOS, use existing GNU coreutils for Linux-oriented fixtures; assertions are not changed.

1. go test ./internal/tooling ./pkg/cli/setup ./pkg/cli/bicep ./pkg/cli/cmd/radinit/... ./pkg/cli/cmd/bicep/publish ./pkg/cli/cmd/bicep/publishextension — expect exact refs/OCI, preserved files and downloaded-template behavior. Passed October 29.
2. for channel in edge 0.62 0.62.0 0.62.0-rc.1 0.61; do go test ./pkg/cli/setup -run 'Test_(GetVersionedBicepConfig|WriteBicepConfig)' -count=1 -ldflags "-X github.com/radius-project/radius/pkg/version.channel=$channel" || exit; done — exact generated channels. Passed.
3. PATH="/opt/homebrew/opt/coreutils/libexec/gnubin:$PATH" make test-release-controller test-release-cutover test-release-publication test-publishing-isolation test-release-oci-artifacts — passed October 29. Includes plan 21, controller 79, resume 5, DE image 10, strict build contract 109, cutover 15, installation, attestation 5, cloud/isolation 19, OCI 19, plus shared alias eligibility, both contracts, RC/no-downgrade and no ACR-latest/GHCR-edge overwrite regressions. Default invocation skips the two opt-in native cases; both ran separately below.
4. node --test .github/scripts/cloud-test-artifacts.test.mjs .github/scripts/bicep-types.test.mjs .github/scripts/azure-oidc-login.test.mjs .github/scripts/release-assets_test.mjs .github/scripts/release-reconciliation_test.mjs — 113 passed, zero failures/skips, including trusted DE edge defaults and explicit dispatch behavior.
5. npm exec --yes --package=prettier@3.9.10 -- prettier --config .github/linters/.prettierrc.yml --check .github/scripts/cloud-test-artifacts.test.mjs .github/scripts/verify-release-manifest_test.mjs bicepconfig.json .radius/bicepconfig.json test/functional-portable/dynamicrp/noncloud/resources/bicepconfig.json — passed.
6. npm exec --yes --package=markdownlint-cli2@0.24.0 -- markdownlint-cli2 docs/contributing/contributing-code/contributing-code-schema-changes/README.md docs/contributing/contributing-code/contributing-code-github-workflows/README.md --config .github/linters/.markdownlint-cli2.yaml — passed. The pinned version is now available; the previous ETARGET limitation no longer applies. cspell lint --config .github/linters/.cspell.yml --no-progress --dot <same-docs> and npm exec --yes --package=markdown-table-formatter@1.7.0 -- markdown-table-formatter <same-docs> --check also passed.
7. actionlint -shellcheck= .github/workflows/functional-test-cloud.yaml .github/workflows/functional-test-noncloud.yaml .github/workflows/long-running-azure.yaml and shellcheck -x --rcfile .github/linters/.shellcheckrc build/scripts/generate-bicepconfig.sh .github/scripts/release-cutover_test.sh — passed, along with git diff --check.

Native local evidence

Start an owned disposable HTTP registry:2 bound only to 127.0.0.1, then run BICEP_RELEASE_NATIVE_REGISTRY=localhost:<port> node --test .github/scripts/publish-release-bicep.test.mjs .github/scripts/promote-release-bicep.test.mjs and remove only that registry. October 29: 37 passed, zero failures/skips, including native immutable full-version consumption, same-digest mirror retries and new shared stable-alias eligibility regressions. The owned container was removed; unrelated buildkit containers were left alone. This is local fixture evidence, not live AWS generation or public production publishing.

Prior October 27 TLS/Kind proof remains applicable, not represented as a new run: consumer Go defaults, shell generator, secure local registry action and Kind DNS action are byte-identical across this rebase. That proof rebuilt source rad (make build-rad-linux-arm64) and used pinned Bicep 0.46.1 in fresh isolated Linux containers with temporary SAN certificates and no host-global trust or /etc/hosts edits. Actual shared-Go general config and actual shell-generated approved image configs asserted canonical Radius/AWS refs and OCI selection first; only Radius's endpoint was mapped locally for typed compilation. Legacy and GHCR stable 0.62.0 and RC 0.62.0-rc.1 config cases all passed. These fixture values are not new provenance claims.

Exact isolated command	October 27 result retained
/proof/bicep publish-extension /proof/types/index.json --target br:localhost:5000/test/radius:edge --force	Expected negative control: HTTP to TLS returns 400.
/proof/bicep publish-extension /proof/types/index.json --target br:radius-registry:5000/test/radius:edge --force	Passed.
/proof/rad bicep publish-extension -f /proof/testresourcetypes.yaml --target br:radius-registry:5000/testresources:edge --force	Passed.
/proof/bicep restore /proof/probe.bicep --force and /proof/bicep build /proof/probe.bicep --stdout	Passed for general config and all four generated legacy/GHCR stable/RC image configs.
/proof/bicep publish /proof/probe.bicep --target br:radius-registry:5000/test/recipe:edge --force	Passed.
/proof/rad bicep publish --file /proof/probe.bicep --target br:radius-registry:5000/test/rad-recipe:edge	Passed.
Independent localhost restore	Passed; the publication negative control is not a universal restore failure.

A separate fresh container and fresh Kind pod resolved/restored/compiled with the exact DNS action and mounted SSL_CERT_DIR trust. Scratch config inode preservation avoided the documented macOS/Podman bind-mount replacement issue; no production workaround. Owned containers, cluster, certificates and kubeconfig were cleaned.

Not claimed: green hosted functional tests, public GHCR end-to-end availability, AWS companion deployment, live release rehearsal or historical backfill. Those operational gates remain unresolved; no registry write was authorized or attempted.

File change summary

File	Summary of change
pkg/cli/setup/bicepconfig.go	GHCR/OCI defaults in current shared O_EXCL writer.
pkg/cli/setup/bicepconfig_test.go	Generated config/channel and custom file/digest preservation.
build/scripts/generate-bicepconfig.sh	General GHCR defaults; approved-plan legacy/GHCR path retained.
internal/tooling/bicep_config_test.go	Generator/config/workflow tests, focused ACR guard and 0.62 coverage.
.github/scripts/release-cutover_test.sh	General-default assertions; full release input contract retained.
.github/scripts/verify-release-manifest_test.mjs	General edge expectation; both tagged contracts and invalid selectors retained.
bicepconfig.json	Radius/AWS GHCR edge and OCI.
.radius/bicepconfig.json	Existing Radius-only config migrates.
test/functional-portable/dynamicrp/noncloud/resources/bicepconfig.json	Production pair migrates; private testresources stays.
.github/workflows/functional-test-cloud.yaml	Public AWS/OCI and TLS alias; trusted parent edge/auth/reporting behavior retained.
.github/workflows/functional-test-noncloud.yaml	AWS/OCI and local TLS targets; upstream DE edge retained.
.github/workflows/long-running-azure.yaml	Production pair/OCI; other registry/settings retained.
.github/actions/create-kind-cluster/action.yaml	Secure registry alias for workload DNS.
.github/scripts/cloud-test-artifacts.test.mjs	Alias/config/CoreDNS regressions and pinned formatting; upstream status/default tests retained.
.github/scripts/test-repo-radius-state-e2e.sh	Generated application config migrates.
.github/workflows/update-resource-types.yaml	GHCR plus compatibility-mirror messaging.
build/generate.mk	Canonical extension examples.
docs/contributing/contributing-code/contributing-code-schema-changes/README.md	Configs, pins, TLS and approved tagged-image exception.
docs/contributing/contributing-code/contributing-code-github-workflows/README.md	Main-based stack, consumer gates, receiver handoffs and TLS/DNS guidance.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

[github-actions]

Unit Tests

    2 files  ±0    420 suites  ±0   21m 10s ⏱️ -2s
7 958 tests +1  7 956 ✅ +1  2 💤 ±0  0 ❌ ±0 
9 134 runs  +1  9 132 ✅ +1  2 💤 ±0  0 ❌ ±0 

Results for commit 1f79821. ± Comparison against base commit 3fb1b25.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.27%. Comparing base (3fb1b25) to head (1f79821).

Additional details and impacted files

@@                           Coverage Diff                           @@
##           willdavsmith-extension-release-cutover   #13181   +/-   ##
=======================================================================
  Coverage                                   69.27%   69.27%           
=======================================================================
  Files                                         735      735           
  Lines                                       40385    40383    -2     
=======================================================================
- Hits                                        27976    27975    -1     
+ Misses                                      12409    12408    -1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	1f79821
Unique ID	func883be3e171
Image tag	test-func883be3e171-40966804390-1

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:test-func883be3e171-40966804390-1
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:test-func883be3e171-40966804390-1
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:test-func883be3e171-40966804390-1
• controller test image location: ghcr.io/radius-project/dev/controller:test-func883be3e171-40966804390-1
• ucp test image location: ghcr.io/radius-project/dev/ucpd:test-func883be3e171-40966804390-1
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:edge

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting ucp-cloud functional tests...
⌛ Starting corerp-cloud functional tests...
❌ Failed to install Radius for corerp-cloud functional test. Please check the logs for more details
❌ Failed to install Radius for ucp-cloud functional test. Please check the logs for more details
❌ corerp-cloud functional test failed. Please check the logs for more details
❌ ucp-cloud functional test failed. Please check the logs for more details