ci(previews): delete preview charts with branch #26

Merged

ryan.mcgee merged 1 commit from ci/preview-cleanup into main

2026-10-20 14:40:00 +00:00

ryan.mcgee commented

2026-10-20 14:37:47 +00:00

Owner

Summary

Preview charts (<version>-pr<N>.<sha>) were never removed, so every PR left packages in the registry. They are now deleted when their branch is.

Changes

.gitea/workflows/preview-cleanup.yaml: runs on the delete event (tags ignored) and on manual dispatch (branch, dry_run defaulting to true).
make clean-preview: maps the branch to its PRs through head.label, lists container versions matching -pr(<PRs>).<7 hex>, deletes each tag and the untagged sha256: manifest version it leaves behind. Release versions, other PRs' previews and packages linked to another repository are skipped.
The branch name is read from the environment, never expanded by make, so $()/backticks in a ref name cannot run commands.
README documents the workflow, token needs and limits.

Verification

Run against a throwaway Forgejo 15.0.9 container (same version string as git.enclaveis.com), not the live forge:

Branch deletion creates an event: delete run, loaded from the default branch. Its payload has ref_type: branch and ref: refs/heads/<name> (full ref, so the recipe strips refs/heads/; this bug was found by that check).
head.label keeps the branch name after deletion; the PR stays open (so cleanup does not depend on PR state).
55 PRs and 128 package versions, so both pagination loops are exercised. Dry run and real run deleted exactly the target PR's previews and left pr10/pr100 (prefix look-alikes), pr2, the release 0.1.0 and a package linked to another repo. Re-running is a no-op. The sha256 manifest version is removed with its tag; release/other previews still resolve (HTTP 200).
A ref name containing $(touch...), backticks and ;, passed through the environment, executed nothing and still matched its own PR.
DRY_RUN=false deletes; DRY_RUN=1 lists. Missing tokens fail with a clear message.
actionlint 1.7.7 on the workflow: clean.

Not verified (no runner available)

A real job run: that github.token can list this repo's PRs, that REGISTRY_TOKEN has write:package and may delete org packages, and that the runner image has make, curl, jq.
First real test after merge: delete a throwaway branch that has a preview, or dispatch the workflow with dry_run on.

## Summary - Preview charts (`<version>-pr<N>.<sha>`) were never removed, so every PR left packages in the registry. They are now deleted when their branch is. ## Changes - `.gitea/workflows/preview-cleanup.yaml`: runs on the `delete` event (tags ignored) and on manual dispatch (`branch`, `dry_run` defaulting to true). - `make clean-preview`: maps the branch to its PRs through `head.label`, lists container versions matching `-pr(<PRs>).<7 hex>`, deletes each tag and the untagged `sha256:` manifest version it leaves behind. Release versions, other PRs' previews and packages linked to another repository are skipped. - The branch name is read from the environment, never expanded by make, so `$()`/backticks in a ref name cannot run commands. - README documents the workflow, token needs and limits. ## Verification Run against a throwaway Forgejo 15.0.9 container (same version string as git.enclaveis.com), not the live forge: - Branch deletion creates an `event: delete` run, loaded from the default branch. Its payload has `ref_type: branch` and `ref: refs/heads/<name>` (full ref, so the recipe strips `refs/heads/`; this bug was found by that check). - `head.label` keeps the branch name after deletion; the PR stays `open` (so cleanup does not depend on PR state). - 55 PRs and 128 package versions, so both pagination loops are exercised. Dry run and real run deleted exactly the target PR's previews and left `pr10`/`pr100` (prefix look-alikes), `pr2`, the release `0.1.0` and a package linked to another repo. Re-running is a no-op. The sha256 manifest version is removed with its tag; release/other previews still resolve (HTTP 200). - A ref name containing `$(touch...)`, backticks and `;`, passed through the environment, executed nothing and still matched its own PR. - `DRY_RUN=false` deletes; `DRY_RUN=1` lists. Missing tokens fail with a clear message. - `actionlint 1.7.7` on the workflow: clean. ## Not verified (no runner available) - A real job run: that `github.token` can list this repo's PRs, that `REGISTRY_TOKEN` has `write:package` and may delete org packages, and that the runner image has `make`, `curl`, `jq`. - First real test after merge: delete a throwaway branch that has a preview, or dispatch the workflow with `dry_run` on.

ryan.mcgee added 1 commit

2026-10-20 14:37:47 +00:00

ci(previews): delete preview charts with branch

Lint charts / lint (pull_request) Successful in 28s

Details

a606dc3a98

- add preview-cleanup workflow on branch delete and manual dispatch
- add make clean-preview: map branch to PRs, delete their -pr<N>.<sha>
  versions and the sha256 manifest version each push leaves behind
- skip release versions and packages linked to another repository
- document in README

ryan.mcgee merged commit cd39277bd3 into main

2026-10-20 14:40:00 +00:00

ryan.mcgee deleted branch ci/preview-cleanup

2026-10-20 14:40:00 +00:00

ryan.mcgee referenced this pull request from a commit

2026-10-20 14:40:01 +00:00

ci(previews): delete preview charts with branch (#26)