ci: trigger azure build for platform-api cloud image on merge

[renuka-fernando]

Purpose

The platform-api cloud image is moving off GitHub Actions/GHCR. Building and pushing the image to the internal control-plane ACR is now owned by an Azure DevOps pipeline, so this workflow should stop building the image and instead trigger that pipeline on merge.

Goals

• Stop building and pushing the cloud image to GHCR from GitHub Actions.
• Trigger the Azure DevOps pipeline (which builds via make cloud-build and pushes to the control-plane ACR) whenever a PR is merged into a release branch.

Approach

• Replace the GHCR build-and-push job with a single job that POSTs an HMAC-SHA1-signed payload (repositoryUrl, branch) to an Azure DevOps incoming webhook.
• Fire on pull_request closed (merged only) into main and platform-api/v0.10.x, plus workflow_dispatch; path-filtered to platform-api/**, common/**, httpkit/**, and the workflow file itself.
• Keep the workflow file identical across release branches, since pull_request runs the workflow from the PR's base branch.
• Requires repository secrets AZURE_WEBHOOK_URL and AZURE_WEBHOOK_SECRET.

User stories

N/A

Documentation

N/A - CI-only change, no product documentation impact.

Automation tests

• Unit tests

  N/A - GitHub Actions workflow change only.

• Integration tests

  N/A

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A (no source changed; workflow YAML only)
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes (uses the AZURE_WEBHOOK_URL / AZURE_WEBHOOK_SECRET GitHub secrets)

Samples

On merge, the workflow signs and POSTs { "repositoryUrl": ..., "branch": ... } to the Azure webhook; the pipeline clones the branch HEAD, runs make cloud-build, and pushes choreocontrolplane.azurecr.io/choreoipaas/platform-api:<branch>-<commit>.

Related PRs

• Azure pipeline this workflow triggers: wso2-enterprise/apim-saas#2915
• Companion workflow change on main: ci: trigger azure build for platform-api cloud image on merge #3282 (same workflow, kept identical).

Test environment

N/A - GitHub Actions (ubuntu-latest).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 19486f1e-567d-4959-8c1b-ec178519af5b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}