Cleanup Old Packages #6
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: MIT | |
| # Copyright (c) 2026 Netresearch DTT GmbH | |
| # | |
| # Weekly GHCR retention for the glpi-php-fpm package. | |
| # | |
| # The daily build.yml pushes a fresh multi-arch image; each push leaves the | |
| # previous build's per-arch child manifests UNTAGGED behind the moving tags | |
| # (latest / 11 / 11.0 / sha-<commit>). Left unchecked these untagged versions | |
| # accumulate forever. This job prunes them and NEVER touches tagged versions | |
| # (no released image is ever deleted here). | |
| # | |
| # Retention is delegated to the shared netresearch/.github reusable so every | |
| # repo prunes GHCR by the same rules; this workflow carries no step-level | |
| # actions of its own. | |
| # | |
| # Why the age-based standard is safe here: every build gets its OWN immutable | |
| # tag — _build-cell.yml attaches `<version>-<YYYYMMDD>` (and `sha-<commit>`) | |
| # to every merge job, so each daily image stays reachable as e.g. | |
| # `11.0.8-20260715` for as long as GHCR keeps it. Rollback targets are TAGGED | |
| # images, and this retention job only ever deletes UNTAGGED versions that no | |
| # tagged manifest still references. | |
| name: Cleanup Old Packages | |
| on: | |
| workflow_dispatch: | |
| inputs: | |
| dry-run: | |
| description: 'List what would be deleted without deleting it' | |
| required: false | |
| type: boolean | |
| default: false | |
| schedule: | |
| # Weekly, Sundays 03:00 UTC. | |
| - cron: '0 3 * * 0' | |
| # Deny by default; the single job opts into packages:write only — which is | |
| # exactly the union of the called workflow's two job permission sets. | |
| permissions: {} | |
| jobs: | |
| cleanup: | |
| name: prune untagged versions | |
| permissions: | |
| packages: write | |
| uses: netresearch/.github/.github/workflows/ghcr-retention.yml@main | |
| with: | |
| package-name: glpi-php-fpm | |
| # This image has NO edge channel and its release tags carry no 'v' | |
| # prefix (bare semver: 11.0.8 / 11.0 / 11, plus 11.0.8-<date>, | |
| # sha-<commit> and the sha256-… signature/attestation tags). Matching | |
| # every tag as a release tag states the guarantee explicitly: a tagged | |
| # version is never deleted, whatever the edge patterns default to. | |
| release-tag-patterns: '*' | |
| # Replaces the previous `keep-n-untagged: 10` count floor. The daily | |
| # rebuild produces one image per day, so a 7-day age floor keeps a | |
| # comparable margin of recent untagged versions — and the versions it | |
| # can delete at all are only those NO tagged manifest references. | |
| orphan-max-age-days: 7 | |
| dry-run: ${{ inputs.dry-run || false }} |