ci(images): clean up stale development images #30

Merged

ryan.mcgee merged 6 commits from ci/clean-development-packages into main 2026-10-20 21:50:19 +00:00

Conversation 1 Commits 6 Files changed 3 +184 -2

ryan.mcgee commented 2026-10-20 21:08:08 +00:00

Owner

Copy link

Summary

• Development images (<version>-dev.<commit>) were never removed, so merged and superseded branches left packages behind.
• A version is now kept only while its commit is the head of a branch other than main. This needs no branch-to-commit mapping, so it also covers superseded pushes and force-pushes.

Changes

• scripts/clean-development.sh: lists both packages, deletes stale -dev.<sha> versions, and deletes the untagged sha256: manifest versions the forge may leave behind, but only when no remaining tag refers to them (directly or as a child of an image index) and they are older than an hour. Releases, latest and development are never deleted. A failed manifest lookup aborts the run before anything is deleted.
• .github/workflows/clean-development.yml: runs when a branch is deleted (merging deletes it), every Sunday as a safety net, and on demand (a manual run is a dry run by default). Uses REGISTRY_TOKEN for the packages and the job token to read the branch list.
• README: describes the cleanup.

Verification

• Mock forge (branches, package listing, registry manifests, deletes): a live branch's image, a release, latest, development, an image index and its child manifest, and a young orphan are kept; merged-branch images, an older-version dev image and unreferenced old manifests are deleted from both packages; development keeps working after its own dev tag is removed; a second run deletes nothing; a failed manifest lookup deletes nothing.
• Real forge, through a temporary probe workflow on this branch (removed in the last commit; it reported as commit statuses): a dry run listed 12 stale versions, among them 1.0.0-dev.9421339; a real run then deleted 14 (the 12 plus two images of this branch's earlier probe commits, superseded by later pushes) with exit 0; a final dry run listed only the next superseded image; the remaining versions of both packages were 1.0.0, latest, development and the branch's current head.
• shellcheck -x and actionlint clean.
• Not run: the delete event trigger (it runs from the default branch once this is merged), and the weekly schedule.

## Summary - Development images (`<version>-dev.<commit>`) were never removed, so merged and superseded branches left packages behind. - A version is now kept only while its commit is the head of a branch other than `main`. This needs no branch-to-commit mapping, so it also covers superseded pushes and force-pushes. ## Changes - `scripts/clean-development.sh`: lists both packages, deletes stale `-dev.<sha>` versions, and deletes the untagged `sha256:` manifest versions the forge may leave behind, but only when no remaining tag refers to them (directly or as a child of an image index) and they are older than an hour. Releases, `latest` and `development` are never deleted. A failed manifest lookup aborts the run before anything is deleted. - `.github/workflows/clean-development.yml`: runs when a branch is deleted (merging deletes it), every Sunday as a safety net, and on demand (a manual run is a dry run by default). Uses `REGISTRY_TOKEN` for the packages and the job token to read the branch list. - README: describes the cleanup. ## Verification - Mock forge (branches, package listing, registry manifests, deletes): a live branch's image, a release, `latest`, `development`, an image index and its child manifest, and a young orphan are kept; merged-branch images, an older-version dev image and unreferenced old manifests are deleted from both packages; `development` keeps working after its own dev tag is removed; a second run deletes nothing; a failed manifest lookup deletes nothing. - Real forge, through a temporary probe workflow on this branch (removed in the last commit; it reported as commit statuses): a dry run listed 12 stale versions, among them `1.0.0-dev.9421339`; a real run then deleted 14 (the 12 plus two images of this branch's earlier probe commits, superseded by later pushes) with exit 0; a final dry run listed only the next superseded image; the remaining versions of both packages were `1.0.0`, `latest`, `development` and the branch's current head. - `shellcheck -x` and `actionlint` clean. - Not run: the `delete` event trigger (it runs from the default branch once this is merged), and the weekly schedule.

ryan.mcgee added 1 commit 2026-10-20 21:08:08 +00:00

ci(images): clean up stale development images ... 35d2d555bd

- delete development versions whose commit is no longer the head of
  a branch, and the untagged manifest versions nothing refers to
- run when a branch is deleted, weekly, and on demand as a dry run
- never touch releases, latest or development

ryan.mcgee added 1 commit 2026-10-20 21:08:19 +00:00

chore: temporary cleanup probe b644b40f3e

forgejo-actions commented 2026-10-20 21:08:34 +00:00

Copy link

cleanup probe (DRY_RUN=1) exit 0

clean-development: branch heads kept: 1
clean-development: would delete traefik-control-sqlite3 1.0.0-dev.35d2d55
clean-development: would delete traefik-control-sqlite3 1.0.0-dev.784734a
clean-development: would delete traefik-control-sqlite3 1.0.0-dev.d648008
clean-development: would delete traefik-control-sqlite3 1.0.0-dev.9421339
clean-development: would delete traefik-control-sqlite3 1.0.0-dev.afe4b1d
clean-development: would delete traefik-control-sqlite3 0.1.0-dev.2e2b361
clean-development: would delete traefik-control-postgres 1.0.0-dev.784734a
clean-development: would delete traefik-control-postgres 1.0.0-dev.9421339
clean-development: would delete traefik-control-postgres 1.0.0-dev.afe4b1d
clean-development: would delete traefik-control-postgres 0.1.0-dev.2e2b361
clean-development: 10 version(s) would be deleted

cleanup probe (DRY_RUN=1) exit 0 ``` clean-development: branch heads kept: 1 clean-development: would delete traefik-control-sqlite3 1.0.0-dev.35d2d55 clean-development: would delete traefik-control-sqlite3 1.0.0-dev.784734a clean-development: would delete traefik-control-sqlite3 1.0.0-dev.d648008 clean-development: would delete traefik-control-sqlite3 1.0.0-dev.9421339 clean-development: would delete traefik-control-sqlite3 1.0.0-dev.afe4b1d clean-development: would delete traefik-control-sqlite3 0.1.0-dev.2e2b361 clean-development: would delete traefik-control-postgres 1.0.0-dev.784734a clean-development: would delete traefik-control-postgres 1.0.0-dev.9421339 clean-development: would delete traefik-control-postgres 1.0.0-dev.afe4b1d clean-development: would delete traefik-control-postgres 0.1.0-dev.2e2b361 clean-development: 10 version(s) would be deleted ```

ryan.mcgee added 1 commit 2026-10-20 21:09:51 +00:00

chore: temporary cleanup probe reports as statuses 5205ee65ff

ryan.mcgee added 1 commit 2026-10-20 21:11:38 +00:00

chore: temporary cleanup probe, real run d18f868acb

ryan.mcgee added 1 commit 2026-10-20 21:13:19 +00:00

chore: temporary cleanup probe, verify b148c49a74

ryan.mcgee added 1 commit 2026-10-20 21:14:58 +00:00

chore: remove temporary cleanup probe 1d306f3ebc

ryan.mcgee merged commit c9a943a6be into main 2026-10-20 21:50:19 +00:00

ryan.mcgee deleted branch ci/clean-development-packages 2026-10-20 21:50:19 +00:00

ryan.mcgee referenced this pull request from a commit 2026-10-20 21:50:20 +00:00

ci(images): clean up stale development images (#30)

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

2 participants

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

White_Ghost_Cyber_Systems/traefik-control!30

No description provided.