feat(docker): align azure base image with dockerized repo conventions

.dockerignore

@@ -2,4 +2,7 @@
 *
 
 # Include
+!Dockerfile
+!LICENSE
 !README.md
+!alpine-packages.txt

.github/dependabot.yml

@@ -2,9 +2,10 @@ version: 2
 updates:
   - package-ecosystem: github-actions
     directory: /
+    target-branch: master
     schedule:
       interval: weekly
-      day: monday
+      day: saturday
       time: "05:00"
       timezone: "UTC"
     assignees:
@@ -13,3 +14,18 @@ updates:
       gha-all:
         patterns:
           - "*"
+
+  - package-ecosystem: docker
+    directory: /
+    target-branch: master
+    schedule:
+      interval: weekly
+      day: saturday
+      time: "05:00"
+      timezone: "UTC"
+    assignees:
+      - ChristophShyper
+    groups:
+      docker-base-images:
+        patterns:
+          - "*"

.github/workflows/auto-pull-request-create.yml

@@ -18,5 +18,5 @@ jobs:
   call:
     uses: devops-infra/.github/.github/workflows/reusable-auto-pull-request-create.yml@v1
     with:
-      profile: other
+      profile: dockerized
     secrets: inherit

.github/workflows/cron-dependency-update.yml

@@ -2,7 +2,7 @@ name: (C) Dependency Update
 
 on:
   schedule:
-    - cron: 0 5 * * 1
+    - cron: 0 5 * * 6
   workflow_dispatch:
 
 permissions:
@@ -12,8 +12,58 @@ permissions:
   issues: read
 
 jobs:
-  call:
-    uses: devops-infra/.github/.github/workflows/reusable-cron-dependency-update.yml@v1
-    with:
-      profile: other
-    secrets: inherit
+  check:
+    name: Check for Azure CLI updates
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install Task
+        uses: go-task/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Install Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Check for new versions
+        run: task dependency:update
+
+      - name: Run linters
+        run: task lint
+
+      - name: Build candidate image
+        if: env.VERSION_TAG != ''
+        run: task docker:build VERSION_PREFIX=test-
+
+      - name: Run container-structure-tests
+        if: env.VERSION_TAG != ''
+        run: task test:structure VERSION_PREFIX=test-
+
+      - name: Commit and push changes
+        if: env.VERSION_TAG != ''
+        uses: devops-infra/action-commit-push@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          target_branch: dependency/${{ env.VERSION_BRANCH }}
+          commit_message: "chore(deps): bump ${{ env.VERSION_TAG }}"
+          signing_mode: ssh
+          signing_key: ${{ secrets.SSH_SIGNING_KEY }}
+
+      - name: Get template
+        if: env.VERSION_TAG != ''
+        run: task git:get-pr-template
+
+      - name: Create pull request
+        if: env.VERSION_TAG != ''
+        uses: devops-infra/action-pull-request@v1
+        with:
+          github_token: ${{ secrets.GITHUB_TOKEN }}
+          target_branch: master
+          title: "chore(deps): bump ${{ env.VERSION_TAG }}"
+          template: .tmp/PULL_REQUEST_TEMPLATE.md
+          get_diff: true

.github/workflows/manual-release-create.yml

@@ -0,0 +1,120 @@
+name: (M) Release Create
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: Azure CLI version to publish. Leave empty to use the Dockerfile version.
+        required: false
+        type: string
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  lint:
+    name: Lint
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install Task
+        uses: go-task/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Run linters
+        run: task lint
+
+  prepare:
+    name: Validate version
+    runs-on: ubuntu-24.04
+    outputs:
+      version: ${{ steps.version.outputs.version }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Install Task
+        uses: go-task/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Resolve version
+        id: version
+        run: |
+          set -eu
+          current="$(task version:get)"
+          requested="${{ inputs.version }}"
+          if [ -n "$requested" ] && [ "$requested" != "$current" ]; then
+            echo "❌ Requested version '$requested' does not match Dockerfile version '$current'"
+            exit 1
+          fi
+          if ! printf '%s' "$current" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "❌ Invalid Azure CLI version: $current"
+            exit 1
+          fi
+          echo "version=$current" >> "$GITHUB_OUTPUT"
+
+  build-and-push:
+    name: Build and push
+    runs-on: ubuntu-24.04
+    timeout-minutes: 90
+    needs: [lint, prepare]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          fetch-tags: true
+
+      - name: Install Task
+        uses: go-task/setup-task@v2
+        with:
+          version: 3.x
+
+      - name: Install Docker Buildx
+        uses: docker/setup-buildx-action@v4
+
+      - name: Install QEMU
+        uses: docker/setup-qemu-action@v4
+        with:
+          image: tonistiigi/binfmt:latest
+          platforms: amd64,arm64
+
+      - name: Build and push images
+        env:
+          BUILDX_NO_DEFAULT_ATTESTATIONS: 1
+          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          VERSION="${{ needs.prepare.outputs.version }}"
+          task docker:push VERSION_OVERRIDE="$VERSION"
+
+      - name: Pull published tags
+        run: |
+          set -eu
+          VERSION="${{ needs.prepare.outputs.version }}"
+          MINOR="$(printf '%s' "$VERSION" | awk -F. '{print $1 "." $2}')"
+          for image in \
+            "devopsinfra/docker-azure-cli:${VERSION}" \
+            "devopsinfra/docker-azure-cli:${MINOR}" \
+            "devopsinfra/docker-azure-cli:latest" \
+            "ghcr.io/devops-infra/docker-azure-cli:${VERSION}" \
+            "ghcr.io/devops-infra/docker-azure-cli:${MINOR}" \
+            "ghcr.io/devops-infra/docker-azure-cli:latest"
+          do
+            docker pull "$image"
+          done
+
+      - name: Run container-structure-tests
+        env:
+          IMAGE: devopsinfra/docker-azure-cli:${{ needs.prepare.outputs.version }}
+        run: |
+          VERSION="${{ needs.prepare.outputs.version }}"
+          task test:structure VERSION_OVERRIDE="$VERSION" IMAGE="$IMAGE"

.pre-commit-config.yaml

@@ -29,6 +29,11 @@ repos:
         entry: bash -lc 'docker run --rm -v "$PWD:/work" -w /work rhysd/actionlint:latest -color'
         language: system
         pass_filenames: false
+      - id: hadolint
+        name: hadolint
+        entry: bash -lc 'docker run --rm -v "$PWD:/work" -w /work hadolint/hadolint:latest-debian /bin/hadolint "$@"' --
+        language: system
+        files: (^|/)Dockerfile(\..*)?$
       - id: shellcheck
         name: shellcheck
         entry: bash -lc 'docker run --rm -v "$PWD:/work" -w /work koalaman/shellcheck:stable -x -S style "$@"' --

Dockerfile

@@ -0,0 +1,18 @@
+FROM alpine:3.24.1
+
+ENV PIP_BREAK_SYSTEM_PACKAGES=1
+
+ARG AZ_VERSION=2.87.0
+
+COPY alpine-packages.txt /tmp/alpine-packages.txt
+
+SHELL ["/bin/ash", "-euxo", "pipefail", "-c"]
+# hadolint ignore=DL3018
+RUN xargs -r apk add --no-cache < /tmp/alpine-packages.txt; \
+  ln -sf /usr/bin/python3 /usr/bin/python; \
+  ln -sf /usr/bin/pip3 /usr/bin/pip; \
+  pip3 install --no-cache-dir "azure-cli==${AZ_VERSION}"; \
+  test "$(az version --output json | jq -r '."azure-cli"')" = "${AZ_VERSION}"; \
+  rm -rf /var/cache/*; \
+  rm -rf /root/.cache/*; \
+  rm -rf /tmp/*