Automate EOL annotation of previous Azure MCP beta container images published to MCR #3857

Background

Azure MCP beta container images published to Microsoft Container Registry (MCR) continue to generate S360 vulnerability findings after newer beta releases become available. These older beta images are not supported, but currently require manual lifecycle management.

Investigation and testing showed that applying an OCI lifecycle artifact with an End-of-Life (EOL) annotation causes the corresponding S360 findings to be removed. A test was successfully performed against 3.0.0-beta.3-amd64, and the associated S360 alerts were cleared.

Proposal

Update the Azure MCP release process so that during publication of a new beta release to MCR:

• Identify the previous beta release.
• Attach an OCI lifecycle artifact containing an EOL date annotation.
• Publish the lifecycle metadata to MCR as part of the release workflow.
• Ensure the process is idempotent and safe to rerun.

oras attach \
  --artifact-type application/vnd.microsoft.artifact.lifecycle \
  --annotation "vnd.microsoft.artifact.lifecycle.end-of-life.date=<date>" \
  $IMAGE

oras discover \
  --artifact-type application/vnd.microsoft.artifact.lifecycle \
  $IMAGE -v --output json

Success Criteria

• Publishing a new Azure MCP beta release automatically marks the previous beta release as EOL.
• Lifecycle annotations are visible when querying the image metadata.
• No manual intervention is required after a new beta release.
• S360 findings for unsupported beta images are suppressed through the approved EOL process.

Notes

• Initial validation showed EOL annotations successfully removed S360 noise.
• This work should be incorporated into the existing Azure MCP MCR publishing workflow.
• Exclude the latest beta release from automatic EOL marking. Only previous beta releases should be annotated.