# .gitea/workflows/registry-gc.yaml
#
# Garbage-collect ORPHANED container images: dev/branch builds whose branch no
# longer exists. Reconciliation model (NOT event-driven) — it lists the live
# branches and every container version, then prunes the mismatch. So it catches
# branches deleted any way (UI, `git push --delete`, API) and never depends on a
# `delete` webhook the runner might not support or might miss.
#
# ┌─ SAFETY — what it will NEVER delete ───────────────────────────────────────┐
# │ * `latest`.                                                                 │
# │ * ANY release / version tag — semver `1.2.3` / `v1.2.3`, spdk `v24.09`, the │
# │   dnsmasq `main-…` line, etc. The guard: only tags ending in a `-<7 hex>`   │
# │   commit-sha suffix are ever CANDIDATES, and ONLY dev/branch builds get     │
# │   that suffix (`<branch>-<sha7>`, spdk `<ver>-<branch>-<sha7>`). Release    │
# │   tags never carry it, so they are structurally out of scope.               │
# │ * Any image whose (sanitized) branch is still LIVE, and anything on `main`. │
# │ * Anything it cannot confidently classify (fail-safe = KEEP).               │
# │ * Everything, if the live-branch list can't be fetched (aborts first).      │
# └────────────────────────────────────────────────────────────────────────────┘
#
# DRY RUN by default. `workflow_dispatch` previews unless dispatched with
# dry_run=false. SCHEDULED runs also dry-run until you ARM them by setting the
# repo variable REGISTRY_GC_ENABLE=true — so you can eyeball a scheduled dry-run
# first, then flip the variable to let it prune automatically.
#
# TOKENS (two, by capability — a package token can't read branches, hence the
# original 403): branch reads use the automatic Actions token (github.token,
# repo read); package list + delete use PACKAGE_TOKEN (write:package, which the
# registry-push token already has). Only touches images THIS repo builds; the
# fleet-kiosk image is owned by the kiosk-app submodule's own CI.

name: registry-gc
run-name: prune orphan container images (dry_run default; ${{ github.event_name }})

on:
  schedule:
    - cron: "17 4 * * *"        # nightly ~04:17 UTC
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Preview only (true) or actually delete (false)"
        type: boolean
        default: true

permissions:
  contents: read                 # branch listing via the auto Actions token

concurrency:
  group: registry-gc
  cancel-in-progress: false

jobs:
  prune:
    runs-on: ubuntu-latest
    env:
      # API base — hardcoded to match the registry host baked into the other
      # workflows' image names (git.bitasylum.org/audiobuzz/*). Keep in sync.
      SERVER: "https://git.bitasylum.org"
      OWNER: ${{ github.repository_owner }}
      REPO: ${{ github.repository }}
      REPO_TOKEN: ${{ github.token }}            # auto Actions token: repo/branch reads
      PKG_TOKEN: ${{ secrets.PACKAGE_TOKEN }}    # package list + delete (write:package)
      EVENT: ${{ github.event_name }}
      DISPATCH_DRY: ${{ inputs.dry_run }}
      GC_ENABLE: ${{ vars.REGISTRY_GC_ENABLE }}
      # Only images built by THIS repo's workflows.
      IMAGES: "fleet-boot fleet-ipxe fleet-dnsmasq spdk-nvmf"
    steps:
      - name: Reconcile registry against live branches
        # The runner defaults `run:` to sh (dash); this script uses bashisms
        # (process substitution, arrays) — force bash. (Cf. gitea-main-ci.yaml.)
        shell: bash
        run: |
          set -euo pipefail
          command -v jq >/dev/null 2>&1 || { sudo apt-get update -qq && sudo apt-get install -y -qq jq; }

          API="${SERVER}/api/v1"

          # Authenticated GET. $1 = which token (repo|pkg), $2 = url. Echoes the
          # body on 2xx; on anything else prints an actionable error and exits
          # (so a scope/auth problem can never be mistaken for "no results").
          get() {
            local who="$1" url="$2" tok tmp code body
            case "$who" in repo) tok="$REPO_TOKEN";; pkg) tok="$PKG_TOKEN";; esac
            tmp="$(mktemp)"
            code="$(curl -sS --retry 3 -o "$tmp" -w '%{http_code}' \
                     -H "Authorization: token ${tok}" -H "Accept: application/json" "$url" || echo 000)"
            body="$(cat "$tmp")"; rm -f "$tmp"
            case "$code" in
              2*) printf '%s' "$body"; return 0 ;;
              401|403)
                echo "::error::GET ${url} -> HTTP ${code} (token '${who}' lacks scope). branches need repo read (github.token); packages need read/write:package (PACKAGE_TOKEN)." >&2
                exit 1 ;;
              *)
                echo "::error::GET ${url} -> HTTP ${code}" >&2
                exit 1 ;;
            esac
          }

          # ---- dry-run resolution ------------------------------------------
          if [ "$EVENT" = "workflow_dispatch" ]; then
            DRY="${DISPATCH_DRY:-true}"
          elif [ "${GC_ENABLE:-}" = "true" ]; then
            DRY="false"
          else
            DRY="true"
            echo "::notice::scheduled run is DRY — set repo variable REGISTRY_GC_ENABLE=true to arm real deletion"
          fi
          echo "event=$EVENT dry_run=$DRY"

          # Sanitize a branch name EXACTLY as the build workflows do, then
          # lowercase (registries lowercase tags). MUST stay in sync with the
          # `safe_branch` sed in {gitea-main-ci,ipxe-image,dnsmasq-image,spdk-image}.yaml.
          sanitize() { printf '%s' "$1" | sed -e 's#[^A-Za-z0-9._-]#-#g' -e 's#^[.-]*##' | cut -c1-80 | tr 'A-Z' 'a-z'; }

          # ---- 1. live branches (fail-safe: abort if none) -----------------
          live=" main "        # main is always protected, even if listing is odd
          total=0 page=1
          while :; do
            resp="$(get repo "${API}/repos/${REPO}/branches?limit=50&page=${page}")"
            cnt="$(printf '%s' "$resp" | jq 'length')"
            [ "$cnt" -eq 0 ] && break
            while IFS= read -r b; do
              [ -n "$b" ] || continue
              live="${live}$(sanitize "$b") "
              total=$((total + 1))
            done < <(printf '%s' "$resp" | jq -r '.[].name')
            page=$((page + 1))
          done
          if [ "$total" -eq 0 ]; then
            echo "::error::fetched 0 live branches — aborting so we never mass-delete on an API/auth failure"
            exit 1
          fi
          echo "live branches ($total):${live}"

          # ---- 2. reconcile each image -------------------------------------
          orphans=0 kept=0 deleted=0 failed=0
          for img in $IMAGES; do
            page=1
            while :; do
              resp="$(get pkg "${API}/packages/${OWNER}?type=container&q=${img}&limit=50&page=${page}")"
              cnt="$(printf '%s' "$resp" | jq 'length')"
              [ "$cnt" -eq 0 ] && break
              while IFS= read -r ver; do
                [ -n "$ver" ] || continue

                # PROTECT releases + latest: a tag WITHOUT the dev commit-sha
                # suffix (`-<7 hex>`) is a release/version/`latest`/`main-ver`
                # tag and is NEVER a candidate. This single rule keeps every real
                # version tag and latest, exactly as required.
                if [ "$ver" = "latest" ] || ! printf '%s' "$ver" | grep -Eq -- '-[0-9a-f]{7}$'; then
                  kept=$((kept + 1)); continue
                fi

                # It's a dev/commit tag. KEEP iff its branch component is a LIVE
                # branch (anchored so `<branch>-<sha>` and spdk `<ver>-<branch>-<sha>`
                # both match). Conservative: a suffix collision only ever causes a
                # KEEP, never a wrongful delete.
                is_live="false"
                for lb in $live; do
                  lre="$(printf '%s' "$lb" | sed 's/\./\\./g')"   # escape regex dots
                  if printf '%s' "$ver" | grep -Eq -- "(^|-)${lre}-[0-9a-f]{7}\$"; then
                    is_live="true"; break
                  fi
                done
                if [ "$is_live" = "true" ]; then kept=$((kept + 1)); continue; fi

                # Orphan: dev tag whose branch is gone.
                orphans=$((orphans + 1))
                echo "ORPHAN  ${img}:${ver}"
                if [ "$DRY" != "true" ]; then
                  code="$(curl -sS -o /dev/null -w '%{http_code}' -X DELETE \
                           -H "Authorization: token ${PKG_TOKEN}" \
                           "${API}/packages/${OWNER}/container/${img}/${ver}" || echo 000)"
                  case "$code" in
                    2*) deleted=$((deleted + 1)); echo "  deleted ${img}:${ver}" ;;
                    *)  failed=$((failed + 1)); echo "::warning::delete ${img}:${ver} returned HTTP ${code}" ;;
                  esac
                fi
              done < <(printf '%s' "$resp" | jq -r --arg n "$img" '.[] | select(.name == $n) | .version')
              page=$((page + 1))
            done
          done

          echo "----------------------------------------------------------------"
          echo "kept=${kept} orphans=${orphans} deleted=${deleted} failed=${failed} dry_run=${DRY}"
          if [ "$DRY" = "true" ] && [ "$orphans" -gt 0 ]; then
            echo "::notice::${orphans} orphan version(s) would be pruned. Dispatch with dry_run=false, or set REGISTRY_GC_ENABLE=true for scheduled runs, to actually delete."
          fi
          [ "$failed" -eq 0 ] || { echo "::error::${failed} deletion(s) failed"; exit 1; }