Require "official" builds have a valid tag.

.pipelines/onebranch/pipeline.buildrp.official.yml

@@ -55,6 +55,7 @@ extends:
           type: linux
 
         variables: # More settings at https://aka.ms/obpipelines/yaml/jobs
+          is_official_release: true
           ob_outputDirectory: $(Build.SourcesDirectory)/out   # this directory is uploaded to pipeline artifacts, reddog and cloudvault. More info at https://aka.ms/obpipelines/artifacts
 
         steps:
@@ -69,6 +70,7 @@ extends:
           os: linux
 
         variables:
+          is_official_release: true
           ob_git_checkout: true
           release_tag: $[stageDependencies.Build_ARO.Build_ARO.outputs['buildaro.releasetag']]
 

.pipelines/onebranch/templates/template-buildrp-buildaro.yml

@@ -9,6 +9,12 @@ steps:
       export COMMIT=$(git rev-parse --short=7 HEAD)$([[ $(git status --porcelain) = "" ]] || echo -dirty)
       if [ -z "$TAG" ];
       then
+        if [ -z "$is_official_release"]
+        then
+          git describe --exact-match
+          echo "Ensure there is an annotated tag (git tag -a) for git commit $(COMMIT)"
+          exit 1
+        fi
         export VERSION=${COMMIT}
       else
         export VERSION=${TAG}

.pipelines/onebranch/templates/template-buildrp-builddocker.yml

@@ -6,7 +6,7 @@ steps:
     dockerFileRelPath: ./Dockerfile.aro-multistage
     dockerFileContextPath: ./
     registry: cdpxb8e9ef87cd634085ab141c637806568c00.azurecr.io
-    arguments: --build-arg REGISTRY=registry.access.redhat.com
+    arguments: --build-arg REGISTRY=registry.access.redhat.com --build-arg IS_OFFICIAL_RELEASE=$(is_official_release)
     saveImageToPath: aro-rp.tar
     buildkit: 1
     enable_network: true

Dockerfile.aro-multistage

@@ -12,7 +12,7 @@ WORKDIR ${GOPATH}/src/github.com/Azure/ARO-RP
 USER root
 RUN yum update -y
 COPY . ${GOPATH}/src/github.com/Azure/ARO-RP/
-RUN make aro && make e2e.test
+RUN if [ "${IS_OFFICIAL_RELEASE}" == "true" ]; then make aro-release; else make aro; fi && make e2e.test
 
 FROM ${REGISTRY}/ubi8/ubi-minimal
 RUN microdnf update && microdnf clean all

Makefile

@@ -39,6 +39,10 @@ build-all:
 aro: generate
 	go build -tags aro,containers_image_openpgp,codec.safe -ldflags "-X github.com/Azure/ARO-RP/pkg/util/version.GitCommit=$(VERSION)" ./cmd/aro
 
+aro-release: generate
+	@[ "${TAG}" ] || ( git describe --exact-match; echo "Ensure there is an annotated tag (git tag -a) for git commit $(COMMIT)"; exit 1 )
+	go build -tags aro,containers_image_openpgp,codec.safe -ldflags "-X github.com/Azure/ARO-RP/pkg/util/version.GitCommit=$(TAG)" ./cmd/aro
+
 runlocal-rp:
 	go run -tags aro,containers_image_openpgp -ldflags "-X github.com/Azure/ARO-RP/pkg/util/version.GitCommit=$(VERSION)" ./cmd/aro rp