fix(ci): make test build work on pull requests from forks

[ganeshkumarashok]

Problem

ci.yaml tags the test image with ${{ secrets.AZURE_REGISTRY_SERVER }}. Secrets are not exposed to pull_request workflows triggered from a fork, so on those runs the expression resolves to an empty string and the tag becomes /public/aks/<repo>:<version>, which buildx rejects:

ERROR: failed to build: invalid tag "/public/aks/aks-gpu-grid:570.211.01-...": invalid reference format

All six build jobs then fail within seconds. Pull requests from forks get no build signal at all, and the red checks are indistinguishable from a genuine breakage — which makes fork PRs hard to review.

This is long-standing rather than new. For example #161 (from a fork) failed this way, while #159 passed only because that run had Secret source: Actions.

Fix

Fall back to a placeholder registry when the secret is unavailable:

-t ${{ secrets.AZURE_REGISTRY_SERVER || 'localhost:5000' }}/public/aks/...

This workflow only builds images — it never runs azure/login, never runs az acr login, and never runs docker push (verified: zero occurrences of each in ci.yaml). The registry portion of the tag is therefore not meaningful here; it only has to be a syntactically valid reference for buildx to accept.

Runs that do have the secret are unaffected and keep tagging exactly as before, since || returns the first truthy operand and a populated secret is truthy.

Validation

• actionlint: 7 pre-existing SC2086 findings on main, 7 on this branch — identical, no new findings introduced.
• Tag resolution checked both ways: secret absent gives localhost:5000/public/aks/... (valid), secret present gives <registry>/public/aks/... (unchanged from today).
• Scope confirmed: this is the only place in ci.yaml where the registry secret is consumed, and it is build-only.

Note

This is intentionally independent of #172 (the workflow expression-injection fix). Both touch the same docker buildx build lines, so whichever merges second will need a trivial conflict resolution — in #172 the fallback simply moves into the env: block as REGISTRY_SERVER: ${{ secrets.AZURE_REGISTRY_SERVER || 'localhost:5000' }}.

[ganeshkumarashok]

Verification

The CI run on this PR passes, but it runs from a branch on this repo, so secrets are present and it does not exercise the fallback. To validate the actual failing configuration I ran a controlled A/B in a fork with no repository secrets (identical to the Secret source: None condition a fork PR gets):

	ref	result
control	unmodified main	❌ failure
treatment	this branch	✅ success (all 6 images)

Control reproduced the reported error exactly:

ERROR: failed to build: invalid tag "/public/aks/aks-gpu-grid:570.211.01-...": invalid reference format
ERROR: failed to build: invalid tag "/public/aks/aks-gpu-cuda:595.71.05-...": invalid reference format

Treatment built every image against the placeholder:

localhost:5000/public/aks/aks-gpu-cuda
localhost:5000/public/aks/aks-gpu-cuda-arm64
localhost:5000/public/aks/aks-gpu-cuda-lts
localhost:5000/public/aks/aks-gpu-cuda-lts-arm64
localhost:5000/public/aks/aks-gpu-grid
localhost:5000/public/aks/aks-gpu-grid-v20

Notes:

• ci.yaml is build-only — no docker push and no azure/login — so the placeholder registry is never contacted.
• When the secret is available (branches on this repo) behaviour is unchanged, as this PR's own green run shows.
• This is pre-existing and unrelated to fix(security): prevent GitHub Actions expression injection in build workflows (CWE-94) #172; PR Skip per-boot update-initramfs when nouveau blacklist is baked into the VHD #161 failed with the same error on an unmodified ci.yaml.