diff --git a/.gitea/workflows/registry-gc.yaml b/.gitea/workflows/registry-gc.yaml new file mode 100644 index 0000000..31640e8 --- /dev/null +++ b/.gitea/workflows/registry-gc.yaml @@ -0,0 +1,162 @@ +# .gitea/workflows/registry-gc.yaml +# +# Garbage-collect ORPHANED container images: dev/branch builds whose branch no +# longer exists. Reconciliation model (NOT event-driven) — it lists the live +# branches and every container version, then prunes the mismatch. So it catches +# branches deleted any way (UI, `git push --delete`, API) and never depends on a +# `delete` webhook the runner might not support or might miss. +# +# ┌─ SAFETY — what it will NEVER delete ───────────────────────────────────────┐ +# │ * `latest`. │ +# │ * ANY release / version tag — semver `1.2.3` / `v1.2.3`, spdk `v24.09`, the │ +# │ dnsmasq `main-…` line, etc. The guard: only tags ending in a `-<7 hex>` │ +# │ commit-sha suffix are ever CANDIDATES, and ONLY dev/branch builds get │ +# │ that suffix (`-`, spdk `--`). Release │ +# │ tags never carry it, so they are structurally out of scope. │ +# │ * Any image whose (sanitized) branch is still LIVE, and anything on `main`. │ +# │ * Anything it cannot confidently classify (fail-safe = KEEP). │ +# │ * Everything, if the live-branch list can't be fetched (aborts first). │ +# └────────────────────────────────────────────────────────────────────────────┘ +# +# DRY RUN by default. `workflow_dispatch` previews unless dispatched with +# dry_run=false. SCHEDULED runs also dry-run until you ARM them by setting the +# repo variable REGISTRY_GC_ENABLE=true — so you can eyeball a scheduled dry-run +# first, then flip the variable to let it prune automatically. +# +# Needs the existing PACKAGE_TOKEN secret (write:package scope, which the +# registry-push token already has). Only touches images THIS repo builds; the +# fleet-kiosk image is owned by the kiosk-app submodule's own CI. + +name: registry-gc +run-name: prune orphan container images (dry_run default; ${{ github.event_name }}) + +on: + schedule: + - cron: "17 4 * * *" # nightly ~04:17 UTC + workflow_dispatch: + inputs: + dry_run: + description: "Preview only (true) or actually delete (false)" + type: boolean + default: true + +concurrency: + group: registry-gc + cancel-in-progress: false + +jobs: + prune: + runs-on: ubuntu-latest + env: + # API base — hardcoded to match the registry host baked into the other + # workflows' image names (git.bitasylum.org/audiobuzz/*). Keep in sync. + SERVER: "https://git.bitasylum.org" + OWNER: ${{ github.repository_owner }} + REPO: ${{ github.repository }} + TOKEN: ${{ secrets.PACKAGE_TOKEN }} + EVENT: ${{ github.event_name }} + DISPATCH_DRY: ${{ inputs.dry_run }} + GC_ENABLE: ${{ vars.REGISTRY_GC_ENABLE }} + # Only images built by THIS repo's workflows. + IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf" + steps: + - name: Reconcile registry against live branches + # The runner defaults `run:` to sh (dash); this script uses bashisms + # (process substitution, arrays) — force bash. (Cf. gitea-main-ci.yaml.) + shell: bash + run: | + set -euo pipefail + command -v jq >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq jq; } + + API="${SERVER}/api/v1" + auth=(-H "Authorization: token ${TOKEN}" -H "Accept: application/json") + + # ---- dry-run resolution ------------------------------------------ + if [ "$EVENT" = "workflow_dispatch" ]; then + DRY="${DISPATCH_DRY:-true}" + elif [ "${GC_ENABLE:-}" = "true" ]; then + DRY="false" + else + DRY="true" + echo "::notice::scheduled run is DRY — set repo variable REGISTRY_GC_ENABLE=true to arm real deletion" + fi + echo "event=$EVENT dry_run=$DRY" + + # Sanitize a branch name EXACTLY as the build workflows do, then + # lowercase (registries lowercase tags). MUST stay in sync with the + # `safe_branch` sed in {gitea-main-ci,ipxe-image,dnsmasq-image,spdk-image}.yaml. + sanitize() { printf '%s' "$1" | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-80 | tr 'A-Z' 'a-z'; } + + # ---- 1. live branches (fail-safe: abort if none) ----------------- + live=" main " # main is always protected, even if listing is odd + total=0 page=1 + while :; do + resp="$(curl -fsSL --retry 3 "${auth[@]}" "${API}/repos/${REPO}/branches?limit=50&page=${page}")" + cnt="$(printf '%s' "$resp" | jq 'length')" + [ "$cnt" -eq 0 ] && break + while IFS= read -r b; do + [ -n "$b" ] || continue + live="${live}$(sanitize "$b") " + total=$((total + 1)) + done < <(printf '%s' "$resp" | jq -r '.[].name') + page=$((page + 1)) + done + if [ "$total" -eq 0 ]; then + echo "::error::fetched 0 live branches — aborting so we never mass-delete on an API/auth failure" + exit 1 + fi + echo "live branches ($total):${live}" + + # ---- 2. reconcile each image ------------------------------------- + orphans=0 kept=0 deleted=0 failed=0 + for img in $IMAGES; do + page=1 + while :; do + resp="$(curl -fsSL --retry 3 "${auth[@]}" "${API}/packages/${OWNER}?type=container&q=${img}&limit=50&page=${page}")" + cnt="$(printf '%s' "$resp" | jq 'length')" + [ "$cnt" -eq 0 ] && break + while IFS= read -r ver; do + [ -n "$ver" ] || continue + + # PROTECT releases + latest: a tag WITHOUT the dev commit-sha + # suffix (`-<7 hex>`) is a release/version/`latest`/`main-ver` + # tag and is NEVER a candidate. This single rule keeps every real + # version tag and latest, exactly as required. + if [ "$ver" = "latest" ] || ! printf '%s' "$ver" | grep -Eq -- '-[0-9a-f]{7}$'; then + kept=$((kept + 1)); continue + fi + + # It's a dev/commit tag. KEEP iff its branch component is a LIVE + # branch (anchored so `-` and spdk `--` + # both match). Conservative: a suffix collision only ever causes a + # KEEP, never a wrongful delete. + is_live="false" + for lb in $live; do + lre="$(printf '%s' "$lb" | sed 's/\./\\./g')" # escape regex dots + if printf '%s' "$ver" | grep -Eq -- "(^|-)${lre}-[0-9a-f]{7}\$"; then + is_live="true"; break + fi + done + if [ "$is_live" = "true" ]; then kept=$((kept + 1)); continue; fi + + # Orphan: dev tag whose branch is gone. + orphans=$((orphans + 1)) + echo "ORPHAN ${img}:${ver}" + if [ "$DRY" != "true" ]; then + code="$(curl -sS -o /dev/null -w '%{http_code}' -X DELETE "${auth[@]}" "${API}/packages/${OWNER}/container/${img}/${ver}" || echo 000)" + case "$code" in + 2*) deleted=$((deleted + 1)); echo " deleted ${img}:${ver}" ;; + *) failed=$((failed + 1)); echo "::warning::delete ${img}:${ver} returned HTTP ${code}" ;; + esac + fi + done < <(printf '%s' "$resp" | jq -r --arg n "$img" '.[] | select(.name == $n) | .version') + page=$((page + 1)) + done + done + + echo "----------------------------------------------------------------" + echo "kept=${kept} orphans=${orphans} deleted=${deleted} failed=${failed} dry_run=${DRY}" + if [ "$DRY" = "true" ] && [ "$orphans" -gt 0 ]; then + echo "::notice::${orphans} orphan version(s) would be pruned. Dispatch with dry_run=false, or set REGISTRY_GC_ENABLE=true for scheduled runs, to actually delete." + fi + [ "$failed" -eq 0 ] || { echo "::error::${failed} deletion(s) failed"; exit 1; }