Addresses the question: "how would i do this when the image tags are set in a GitHub action for deployment?"

The existing publish-image-to-acr.yml already pushes images with commit SHA tags, but k8s/job.yaml was hardcoded to :latest. This creates non-deterministic deployments and complicates rollbacks.

Changes

• New deployment workflow (.github/workflows/deploy-to-k8s.yml)

  • Triggers after successful image builds via workflow_run
  • Dynamically substitutes :latest with commit SHA using sed before applying to cluster
  • Supports manual deployment with custom tags via workflow_dispatch

• Documentation (k8s/README.md)

  • Explains image tagging strategy and deployment flow
  • Documents rollback procedure using commit SHAs

Approach

The job.yaml file retains :latest in source control for local development. During deployment, the workflow substitutes the tag:

# In repo: job.yaml
image: doppaacr.azurecr.io/osm-pipeline:latest

# Deployed to cluster:
image: doppaacr.azurecr.io/osm-pipeline:abc123def456...

This enables deterministic production deployments while keeping local development simple.

Configuration Required

The deployment workflow requires these repository secrets:

• AZURE_CREDENTIALS
• AKS_RESOURCE_GROUP
• AKS_CLUSTER_NAME

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.