Remove dependency on authenticated Azure Container Registry for Linux CI images

[saurabh500]

Is your feature request related to a problem? Please describe.

The Linux build and test stages in OneBranchPipelines/ pull their container images from tdslibrs.azurecr.io, a private Azure Container Registry. Because the registry requires authentication, every stage that needs an image has to run an AzureCLI@2 task to az acr login --name tdslibrs, which in turn depends on the Magnitude Test-mssql-rs-mssql-python Azure service connection.

This creates several problems:

• Coupling to a service connection. Any expiry, permission change, or subscription move on Magnitude Test-mssql-rs-mssql-python breaks the Linux build, ODBC build, and wheel-installation-test stages simultaneously.
• Extra failure surface and latency. Each affected stage carries an additional authentication step that can fail independently of the actual build.
• Hard to reproduce locally. A contributor without access to the ACR cannot pull the same image the pipeline uses, making it difficult to reproduce Linux-specific build or packaging failures.
• Registry ownership is outside this repo. The images are mirrored into the ACR by a pipeline in microsoft/mssql-rs, so the authentication requirement is inherited rather than something this repo controls.

Affected stages:

• OneBranchPipelines/stages/build-linux-single-stage.yml
• OneBranchPipelines/stages/build-odbc-linux-stage.yml
• OneBranchPipelines/stages/wheel-installation-test-stage.yml

Describe the solution you'd like

Point these stages at the equivalent images published to GitHub Container Registry by microsoft/mssql-rs, and drop the ACR login steps entirely:

Before	After
tdslibrs.azurecr.io/import/python-build/manylinux_2_28_<arch>:latest	ghcr.io/microsoft/mssql-rs/import/python-build/manylinux_2_28_<arch>:latest
tdslibrs.azurecr.io/import/python-build/musllinux_1_2_<arch>:latest	ghcr.io/microsoft/mssql-rs/import/python-build/musllinux_1_2_<arch>:latest

The GHCR packages are public, so pulls are anonymous. That means:

• The three AzureCLI@2 "Login to ACR (tdslibrs)" steps can be removed.
• The Magnitude Test-mssql-rs-mssql-python service connection is no longer needed for image access in these stages.
• Contributors can pull the exact CI image locally with a plain docker pull.

These are the same vanilla PyPA base images as before, just served from a different registry — no change to the toolchain inside the containers.

Describe alternatives you've considered

• Keep the ACR and accept the login steps. Rejected: it preserves all of the coupling and reproducibility problems above for no benefit, given a public mirror already exists.
• Pull directly from quay.io/pypa/* upstream. This would remove the authentication requirement too, but gives up the controlled mirror that microsoft/mssql-rs maintains, and exposes CI to upstream availability and rate limiting.
• Use the _rust image variants on GHCR (python-build/manylinux_2_28_<arch>_rust). These were mirrored first and are also public, but they bundle a Rust/maturin toolchain that these stages do not use. The import/python-build/* paths are an exact 1:1 match for the ACR paths being replaced.

Additional context

Verified that all four tags are anonymously pullable from GHCR (HTTP 200 against the registry API for manylinux_2_28_{x86_64,aarch64}:latest and musllinux_1_2_{x86_64,aarch64}:latest).

Note that $(ARCH) in these pipelines already resolves to x86_64 / aarch64, which matches the GHCR tag naming exactly, so no tag-mapping logic is needed.

This is not a full removal of ACR from the repo — the OneBranch stages still reference onebranch.azurecr.io images for the build agents themselves, which is a separate concern owned by the OneBranch platform.

[github-actions]

Hi @saurabh500, thank you for opening this issue!

Our team will review it shortly. We aim to triage all new issues within 24-48 hours and get back to you.

If you have additional information to share, please feel free to update the issue.

Thank you for your patience!