ado-registry-push

ado-registry-push

Produces the Azure DevOps DockerBuildPush stage tasks for pushing a Docker image to a container registry. Registry type is resolved from registry.type in .devops-agent.json or prompted when unset. Supported targets: ACR and ECR.

Image Tagging

All generated registry push steps apply two tags:

• $(Build.BuildId) — immutable, unique per build
• latest — floating tag always pointing to the most recent successful build

tags: |
  $(tag)
  latest

$(tag) is mapped to $(Build.BuildId) in the pipeline-level variables block.

ACR — Azure Container Registry

Use the Docker@2 task with the buildAndPush command and an ACR service connection.

Prerequisites

• An ACR service connection named ACRServiceConnection (configurable) created in the ADO project settings under Service Connections.
• The service principal backing the service connection must have the AcrPush role on the registry.

ACR Task YAML

- stage: DockerBuildPush
  displayName: 'Docker Build & Push (ACR)'
  dependsOn:
    - UnitTest
    - SonarScan
    - SnykScan
  jobs:
    - job: Docker
      pool:
        name: 'OrgLinuxPool'
      steps:
        - task: Docker@2
          displayName: 'Build and push to ACR'
          inputs:
            containerRegistry: 'ACRServiceConnection'
            repository: '$(imageName)'
            command: 'buildAndPush'
            Dockerfile: '**/Dockerfile'
            tags: |
              $(tag)
              latest

ACR Variables

variables:
  registry: 'yourorg.azurecr.io'
  imageName: '$(Build.Repository.Name)'
  tag: '$(Build.BuildId)'

The Docker@2 task with buildAndPush uses containerRegistry to resolve the full image path: <registry>/<repository>:<tag>. The registry variable is only needed if constructing image references manually elsewhere in the pipeline.

ECR — AWS Elastic Container Registry

Use the AWSShellScript@1 task (AWS Toolkit for Azure DevOps extension) to authenticate with ECR using aws ecr get-login-password, then build and push with the Docker CLI.

Prerequisites

• The AWS Toolkit for Azure DevOps extension installed in the ADO organisation.
• An AWS service connection named AWSServiceConnection (configurable) in ADO project settings.
• The IAM role/user backing the connection must have ecr:GetAuthorizationToken, ecr:BatchCheckLayerAvailability, ecr:PutImage, ecr:InitiateLayerUpload, ecr:UploadLayerPart, and ecr:CompleteLayerUpload permissions.

ECR Task YAML

- stage: DockerBuildPush
  displayName: 'Docker Build & Push (ECR)'
  dependsOn:
    - UnitTest
    - SonarScan
    - SnykScan
  jobs:
    - job: Docker
      pool:
        name: 'OrgLinuxPool'
      steps:
        - task: AWSShellScript@1
          displayName: 'Build and push to ECR'
          inputs:
            awsCredentials: 'AWSServiceConnection'
            regionName: '$(awsRegion)'
            scriptType: 'inline'
            inlineScript: |
              aws ecr get-login-password --region $(awsRegion) \
                | docker login --username AWS --password-stdin $(ecrRegistry)
              docker build -t $(ecrRegistry)/$(imageName):$(tag) .
              docker tag $(ecrRegistry)/$(imageName):$(tag) $(ecrRegistry)/$(imageName):latest
              docker push $(ecrRegistry)/$(imageName):$(tag)
              docker push $(ecrRegistry)/$(imageName):latest

ECR Variables

variables:
  awsRegion: 'us-east-1'
  ecrRegistry: '123456789012.dkr.ecr.us-east-1.amazonaws.com'
  imageName: '$(Build.Repository.Name)'
  tag: '$(Build.BuildId)'

Replace awsRegion and ecrRegistry with the actual values. Store the ECR registry URL in a variable group rather than hardcoding it in the pipeline YAML.

Registry Selection

The skill reads registry.type from .devops-agent.json:

registry.type	Generated tasks
acr	Docker@2 with buildAndPush
ecr	AWSShellScript@1 with inline ECR login + docker push
(unset)	Prompt the user to choose ACR or ECR before generating

The service connection name defaults are overridable:

{
  "registry": {
    "type": "acr",
    "serviceConnection": "MyCustomACRConnection"
  }
}

Security Notes

• Never inline registry credentials in pipeline YAML. Use service connections for ACR and AWSShellScript@1 with an AWS service connection for ECR.
• Do not pass --password to docker login directly in scripts. Always pipe from aws ecr get-login-password or equivalent.
• Store ecrRegistry and awsRegion in a variable group, not hardcoded in YAML, so they can be rotated without a code change.