[willdavsmith]

Summary

Draft consumer-only companion for the Radius/AWS Bicep extension ACR-to-GHCR migration. The actual config generation path, .github/scripts/update-bicepconfig.sh, now uses:

• br:ghcr.io/radius-project/bicep-types-radius:edge
• br:ghcr.io/radius-project/bicep-types-aws:edge

It enables experimentalFeaturesEnabled.ociEnabled, migrates only the legacy Radius/AWS aliases, maps ACR development latest to GHCR edge, and preserves stable-channel/full-version tags. Existing custom references, other extensions, experimental flags, analyzer/cloud/module-alias settings, and local *-extension.tgz merging are preserved. Malformed JSON fails without replacing the original config.

No recipe targets, container images, Test tenant, historical files, publishers, release rewrites, repository settings, or secrets are changed. Remaining ACR strings are the legacy-match expression and regression fixtures; there are no remaining checked-in active ACR consumer defaults. No ACR fallback is introduced.

Reason for change

The config generator is used by resource-type builds and Recipe Pack deployment. Updating only upstream publishers would leave this consumer creating ACR-backed configs. This PR covers that bounded consumer path; source publishing/release orchestration remain in the upstream work, including radius-project/radius#13119, which this PR does not modify.

Issue: N/A.

Do not merge until all pre-merge gates pass:

• Both canonical GHCR packages are public and anonymously pullable for edge and any stable/full-version tags selected by consumers. Anonymous token requests for both packages returned HTTP 403 on 2026-10-01; public availability is not established.
• Verify a released Radius CLI actually uses Bicep >= 0.45.6, and record the release and rad version output. Upstream Bicep v0.45.6 introduced experimental OCI support. radius-project/radius#13075 is merged, and released v0.61.1 source pins v0.46.1; this is source evidence, not released-binary certification. The local installed Radius v0.60.0 reports Bicep 0.42.1 and is incompatible. Do not treat edge alone as release evidence.
• Using that released CLI, anonymously restore both public extensions and compile representative Radius/AWS consumers with this generated config and OCI enabled. The coordinating upstream investigation tested pinned Bicep 0.46.1 native OCI publish, anonymous restore, and typed compilation using disposable registries; that is not end-to-end public canonical-artifact validation.
• Required CI passes, including the Linux release-automation suite and the new offline config fixtures.

Keep this PR draft until these gates are satisfied. No production publishing, merge, ready-for-review, or auto-merge action is included.

How to test

Commands run from the repository root:

Exact command	Result
make test-bicepconfig test-workspace-bootstrap	Passed. Fresh/existing config, idempotency, legacy development/stable/full-version/prerelease tags, custom/already-GHCR references, unrelated settings/extensions, paths with spaces, local extension replacement, missing alias, invalid JSON, and temporary-file cleanup are covered.
bash -n .github/scripts/update-bicepconfig.sh .github/scripts/tests/test-update-bicepconfig.sh .github/scripts/deploy-recipe-pack.sh	Passed.
shellcheck .github/scripts/update-bicepconfig.sh .github/scripts/tests/test-update-bicepconfig.sh .github/scripts/deploy-recipe-pack.sh	Passed.
ruby -e 'require "yaml"; YAML.load_file(".github/workflows/validate-resource-types.yaml"); puts "Workflow YAML parsed"'	Passed.
git diff --check	Passed before commit.
make test-bicepconfig test-release-automation test-workspace-bootstrap	Config tests passed; release-automation tests stopped at the pre-existing GNU sed -i assumption in .github/scripts/tests/test-release-automation.sh:252 on macOS (invalid command code f). Workspace bootstrap was subsequently run separately and passed. No unrelated portability change is included.
rad version	Installed Radius v0.60.0 / Bicep 0.42.1; not compatible with this migration.
for name in radius aws; do printf '%s anonymous token HTTP status: ' "$name"; curl -sS -o /dev/null -w '%{http_code}\n' "https://ghcr.io/token?service=ghcr.io&scope=repository:radius-project/bicep-types-${name}:pull"; done	Both returned HTTP 403 without credentials; public restore gate remains open.

make test, make test-recipe, registry publishing, and live deployment were not run: no compatible released CLI has been certified locally and canonical public artifacts are not yet anonymously accessible. Offline fixtures do not claim deployment or public restore success.

File change summary

File	Summary of change
.github/scripts/update-bicepconfig.sh	Merge OCI flag/canonical refs, narrowly migrate legacy aliases, preserve configuration and local extensions, surface jq failures and clean temporary files.
.github/scripts/tests/test-update-bicepconfig.sh	Add isolated, offline shell fixtures for migration and preservation behavior.
.github/build/test.mk	Expose make test-bicepconfig.
.github/workflows/validate-resource-types.yaml	Run focused fixtures in existing validation job.
.github/scripts/deploy-recipe-pack.sh	Update the config updater contract comment.
docs/contributing/testing-resource-types-recipes.md	Document config refresh, compatibility requirements, focused tests, and explicit pre-merge gates.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None