Merge pull request 'ci: add registry-gc — prune orphan container images for deleted branches' (#13) from registry-gc into main
Reviewed-on: https://git.bitasylum.org/audiobuzz/diskless-workstation/pulls/13
This commit is contained in:
audiobuzz
@@ -0,0 +1,162 @@
|
|||||||
|
# .gitea/workflows/registry-gc.yaml
|
||||||
|
#
|
||||||
|
# Garbage-collect ORPHANED container images: dev/branch builds whose branch no
|
||||||
|
# longer exists. Reconciliation model (NOT event-driven) — it lists the live
|
||||||
|
# branches and every container version, then prunes the mismatch. So it catches
|
||||||
|
# branches deleted any way (UI, `git push --delete`, API) and never depends on a
|
||||||
|
# `delete` webhook the runner might not support or might miss.
|
||||||
|
#
|
||||||
|
# ┌─ SAFETY — what it will NEVER delete ───────────────────────────────────────┐
|
||||||
|
# │ * `latest`. │
|
||||||
|
# │ * ANY release / version tag — semver `1.2.3` / `v1.2.3`, spdk `v24.09`, the │
|
||||||
|
# │ dnsmasq `main-…` line, etc. The guard: only tags ending in a `-<7 hex>` │
|
||||||
|
# │ commit-sha suffix are ever CANDIDATES, and ONLY dev/branch builds get │
|
||||||
|
# │ that suffix (`<branch>-<sha7>`, spdk `<ver>-<branch>-<sha7>`). Release │
|
||||||
|
# │ tags never carry it, so they are structurally out of scope. │
|
||||||
|
# │ * Any image whose (sanitized) branch is still LIVE, and anything on `main`. │
|
||||||
|
# │ * Anything it cannot confidently classify (fail-safe = KEEP). │
|
||||||
|
# │ * Everything, if the live-branch list can't be fetched (aborts first). │
|
||||||
|
# └────────────────────────────────────────────────────────────────────────────┘
|
||||||
|
#
|
||||||
|
# DRY RUN by default. `workflow_dispatch` previews unless dispatched with
|
||||||
|
# dry_run=false. SCHEDULED runs also dry-run until you ARM them by setting the
|
||||||
|
# repo variable REGISTRY_GC_ENABLE=true — so you can eyeball a scheduled dry-run
|
||||||
|
# first, then flip the variable to let it prune automatically.
|
||||||
|
#
|
||||||
|
# Needs the existing PACKAGE_TOKEN secret (write:package scope, which the
|
||||||
|
# registry-push token already has). Only touches images THIS repo builds; the
|
||||||
|
# fleet-kiosk image is owned by the kiosk-app submodule's own CI.
|
||||||
|
|
||||||
|
name: registry-gc
|
||||||
|
run-name: prune orphan container images (dry_run default; ${{ github.event_name }})
|
||||||
|
|
||||||
|
on:
|
||||||
|
schedule:
|
||||||
|
- cron: "17 4 * * *" # nightly ~04:17 UTC
|
||||||
|
workflow_dispatch:
|
||||||
|
inputs:
|
||||||
|
dry_run:
|
||||||
|
description: "Preview only (true) or actually delete (false)"
|
||||||
|
type: boolean
|
||||||
|
default: true
|
||||||
|
|
||||||
|
concurrency:
|
||||||
|
group: registry-gc
|
||||||
|
cancel-in-progress: false
|
||||||
|
|
||||||
|
jobs:
|
||||||
|
prune:
|
||||||
|
runs-on: ubuntu-latest
|
||||||
|
env:
|
||||||
|
# API base — hardcoded to match the registry host baked into the other
|
||||||
|
# workflows' image names (git.bitasylum.org/audiobuzz/*). Keep in sync.
|
||||||
|
SERVER: "https://git.bitasylum.org"
|
||||||
|
OWNER: ${{ github.repository_owner }}
|
||||||
|
REPO: ${{ github.repository }}
|
||||||
|
TOKEN: ${{ secrets.PACKAGE_TOKEN }}
|
||||||
|
EVENT: ${{ github.event_name }}
|
||||||
|
DISPATCH_DRY: ${{ inputs.dry_run }}
|
||||||
|
GC_ENABLE: ${{ vars.REGISTRY_GC_ENABLE }}
|
||||||
|
# Only images built by THIS repo's workflows.
|
||||||
|
IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf"
|
||||||
|
steps:
|
||||||
|
- name: Reconcile registry against live branches
|
||||||
|
# The runner defaults `run:` to sh (dash); this script uses bashisms
|
||||||
|
# (process substitution, arrays) — force bash. (Cf. gitea-main-ci.yaml.)
|
||||||
|
shell: bash
|
||||||
|
run: |
|
||||||
|
set -euo pipefail
|
||||||
|
command -v jq >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq jq; }
|
||||||
|
|
||||||
|
API="${SERVER}/api/v1"
|
||||||
|
auth=(-H "Authorization: token ${TOKEN}" -H "Accept: application/json")
|
||||||
|
|
||||||
|
# ---- dry-run resolution ------------------------------------------
|
||||||
|
if [ "$EVENT" = "workflow_dispatch" ]; then
|
||||||
|
DRY="${DISPATCH_DRY:-true}"
|
||||||
|
elif [ "${GC_ENABLE:-}" = "true" ]; then
|
||||||
|
DRY="false"
|
||||||
|
else
|
||||||
|
DRY="true"
|
||||||
|
echo "::notice::scheduled run is DRY — set repo variable REGISTRY_GC_ENABLE=true to arm real deletion"
|
||||||
|
fi
|
||||||
|
echo "event=$EVENT dry_run=$DRY"
|
||||||
|
|
||||||
|
# Sanitize a branch name EXACTLY as the build workflows do, then
|
||||||
|
# lowercase (registries lowercase tags). MUST stay in sync with the
|
||||||
|
# `safe_branch` sed in {gitea-main-ci,ipxe-image,dnsmasq-image,spdk-image}.yaml.
|
||||||
|
sanitize() { printf '%s' "$1" | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-80 | tr 'A-Z' 'a-z'; }
|
||||||
|
|
||||||
|
# ---- 1. live branches (fail-safe: abort if none) -----------------
|
||||||
|
live=" main " # main is always protected, even if listing is odd
|
||||||
|
total=0 page=1
|
||||||
|
while :; do
|
||||||
|
resp="$(curl -fsSL --retry 3 "${auth[@]}" "${API}/repos/${REPO}/branches?limit=50&page=${page}")"
|
||||||
|
cnt="$(printf '%s' "$resp" | jq 'length')"
|
||||||
|
[ "$cnt" -eq 0 ] && break
|
||||||
|
while IFS= read -r b; do
|
||||||
|
[ -n "$b" ] || continue
|
||||||
|
live="${live}$(sanitize "$b") "
|
||||||
|
total=$((total + 1))
|
||||||
|
done < <(printf '%s' "$resp" | jq -r '.[].name')
|
||||||
|
page=$((page + 1))
|
||||||
|
done
|
||||||
|
if [ "$total" -eq 0 ]; then
|
||||||
|
echo "::error::fetched 0 live branches — aborting so we never mass-delete on an API/auth failure"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "live branches ($total):${live}"
|
||||||
|
|
||||||
|
# ---- 2. reconcile each image -------------------------------------
|
||||||
|
orphans=0 kept=0 deleted=0 failed=0
|
||||||
|
for img in $IMAGES; do
|
||||||
|
page=1
|
||||||
|
while :; do
|
||||||
|
resp="$(curl -fsSL --retry 3 "${auth[@]}" "${API}/packages/${OWNER}?type=container&q=${img}&limit=50&page=${page}")"
|
||||||
|
cnt="$(printf '%s' "$resp" | jq 'length')"
|
||||||
|
[ "$cnt" -eq 0 ] && break
|
||||||
|
while IFS= read -r ver; do
|
||||||
|
[ -n "$ver" ] || continue
|
||||||
|
|
||||||
|
# PROTECT releases + latest: a tag WITHOUT the dev commit-sha
|
||||||
|
# suffix (`-<7 hex>`) is a release/version/`latest`/`main-ver`
|
||||||
|
# tag and is NEVER a candidate. This single rule keeps every real
|
||||||
|
# version tag and latest, exactly as required.
|
||||||
|
if [ "$ver" = "latest" ] || ! printf '%s' "$ver" | grep -Eq -- '-[0-9a-f]{7}$'; then
|
||||||
|
kept=$((kept + 1)); continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
# It's a dev/commit tag. KEEP iff its branch component is a LIVE
|
||||||
|
# branch (anchored so `<branch>-<sha>` and spdk `<ver>-<branch>-<sha>`
|
||||||
|
# both match). Conservative: a suffix collision only ever causes a
|
||||||
|
# KEEP, never a wrongful delete.
|
||||||
|
is_live="false"
|
||||||
|
for lb in $live; do
|
||||||
|
lre="$(printf '%s' "$lb" | sed 's/\./\\./g')" # escape regex dots
|
||||||
|
if printf '%s' "$ver" | grep -Eq -- "(^|-)${lre}-[0-9a-f]{7}\$"; then
|
||||||
|
is_live="true"; break
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
if [ "$is_live" = "true" ]; then kept=$((kept + 1)); continue; fi
|
||||||
|
|
||||||
|
# Orphan: dev tag whose branch is gone.
|
||||||
|
orphans=$((orphans + 1))
|
||||||
|
echo "ORPHAN ${img}:${ver}"
|
||||||
|
if [ "$DRY" != "true" ]; then
|
||||||
|
code="$(curl -sS -o /dev/null -w '%{http_code}' -X DELETE "${auth[@]}" "${API}/packages/${OWNER}/container/${img}/${ver}" || echo 000)"
|
||||||
|
case "$code" in
|
||||||
|
2*) deleted=$((deleted + 1)); echo " deleted ${img}:${ver}" ;;
|
||||||
|
*) failed=$((failed + 1)); echo "::warning::delete ${img}:${ver} returned HTTP ${code}" ;;
|
||||||
|
esac
|
||||||
|
fi
|
||||||
|
done < <(printf '%s' "$resp" | jq -r --arg n "$img" '.[] | select(.name == $n) | .version')
|
||||||
|
page=$((page + 1))
|
||||||
|
done
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "----------------------------------------------------------------"
|
||||||
|
echo "kept=${kept} orphans=${orphans} deleted=${deleted} failed=${failed} dry_run=${DRY}"
|
||||||
|
if [ "$DRY" = "true" ] && [ "$orphans" -gt 0 ]; then
|
||||||
|
echo "::notice::${orphans} orphan version(s) would be pruned. Dispatch with dry_run=false, or set REGISTRY_GC_ENABLE=true for scheduled runs, to actually delete."
|
||||||
|
fi
|
||||||
|
[ "$failed" -eq 0 ] || { echo "::error::${failed} deletion(s) failed"; exit 1; }
|
||||||
Reference in New Issue
Block a user