[sulixu]

Summary

• Split image build and push into separate steps in the cuda, cuda-arm64, and grid publication jobs.
• Run azure/login after the build, immediately before az acr login and docker push.
• Keep the existing build commands, platforms, image tags, cache settings, action versions, and permissions unchanged.

Cause

The publication run after #177 failed at registry authentication, after the images had built successfully:

https://github.com/Azure/aks-gpu/actions/runs/37664513588

In the CUDA LTS job, the OIDC assertion expired at 2026-10-07T18:14:14Z, but az acr login ran at 18:23:13Z and failed with AADSTS700024. The GRID job had the same failure. The workflow requested the assertion before a long image build.

This change requests a fresh assertion after the build. The push step sets its own environment and image reference because shell variables do not persist between steps.

Validation

• git diff --check: passed.
• Parsed the workflow with Ruby YAML and checked that only the build/login/push step arrangement changed in all three jobs.
• bash -n and ShellCheck: passed for all 18 shell blocks in the publication workflow.
• Mocked Docker and Azure commands for all six matrix entries: the build and push tags match, registry login precedes push, and a failed registry login prevents push.

No live Azure login or image publication was run locally. PR CI builds images without publishing them. A new publication run from the updated main branch must verify the live registry login and push after merge.