fix: migrate Docker push from deprecated MSI to WIF service connection

[BrendanWalsh]

Summary

Switches Docker image push steps from the deprecated SynapseML MCR MSI service connection (Managed Service Identity) to the existing SynapseML MCR connection (Workload Identity Federation).

Problem

The SynapseML MCR MSI service connection uses MSI-based auth, which was deprecated by OneBranch in June 2025. The MSI can no longer fetch access tokens on hosted build agents, blocking any Docker image publishing to mmlsparkmcr ACR.

Fix

A WIF-based service connection (SynapseML MCR) already exists in ADO, is ready, and not disabled. This PR simply updates the 3 Docker push steps to reference it:

• Demo Image Push (line 291)
• Minimal Image Push (line 299)
• Release Image Push (line 314)

Verification

After merge, run the pipeline with publishDockerImages: true (no tag) to validate that auth to mmlsparkmcr ACR works. This will push build-demo and build-minimal without touching release.

Related

• IcM 31000000570827 (CVE-2023-44487 in mmlspark/release) — this unblocks the image publish needed to resolve that incident
• PR fix: Fix CVE-2023-44487 in mmlspark/release Docker image #2520 (Docker image CVE fix, merged)

[github-actions]

Hey @BrendanWalsh 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Snapshot Warnings

⚠️: No snapshots were found for the head SHA a884e56.

Ensure that dependencies are being submitted on PR branches and consider enabling retry-on-snapshot-warnings. See the documentation for more information and troubleshooting advice.

Scanned Files

None