cleanup_images.yml

name: Cleanup ghcr.io

on:
  pull_request:
    types: [closed]
  schedule:
    - cron: '0 19 */3 * *'  # Every 3 days after 7 PM
  workflow_dispatch:
    inputs:
      dry-run:
        description: Dry run (do not delete images)
        required: false
        type: boolean
        default: true
      tags:
        description: Tags to delete for all the images (regexp enabled)
        required: false
        type: string
      untagged:
        description: Delete untagged images
        required: false
        type: boolean
        default: false

env:
  ORG: Alfresco
  REPO: alfresco-dockerfiles-bakery
  CACHE_REPO: bakery-cache

concurrency:
  group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.event.pull_request.number }}${{ inputs.tags }}
  cancel-in-progress: true

jobs:
  cleanup:
    if: github.actor != 'dependabot[bot]' && ! github.event.pull_request.head.repo.fork
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Get package names from bake definition
        env:
          JQ_FILTER: >-
            .target
            | map(select(.output | index("type=docker")))
            | map(.tags[] | split("/")[-1] | split(":")[0])
            | join(",")
        run: |
          echo PACKAGE_NAMES=$(docker buildx bake --print | jq -r '${{ env.JQ_FILTER }}') >> $GITHUB_ENV

      - name: Remove tags after PR is closed
        uses: dataaxiom/ghcr-cleanup-action@98b4022383d6ddb70ccbf6a378b4d8c67a60f066 # v1.0.13
        if: github.event_name == 'pull_request'
        env:
          PR_TAGS: ${{ format('pr-{0}*', github.event.pull_request.number) }}
        with:
          token: ${{ secrets.DELETE_PACKAGES_GITHUB_TOKEN }}
          owner: ${{ env.ORG }}
          repository: ${{ env.REPO }}
          packages: ${{ env.PACKAGE_NAMES }}
          delete-tags: ${{ env.PR_TAGS }}
          dry-run: false

      - name: Remove images when requested
        uses: dataaxiom/ghcr-cleanup-action@98b4022383d6ddb70ccbf6a378b4d8c67a60f066 # v1.0.13
        if: github.event_name == 'schedule' || github.event_name == 'workflow_dispatch'
        with:
          token: ${{ secrets.DELETE_PACKAGES_GITHUB_TOKEN }}
          owner: ${{ env.ORG }}
          repository: ${{ env.REPO }}
          packages: ${{ env.PACKAGE_NAMES }},${{ env.CACHE_REPO }}
          delete-untagged: ${{ github.event_name == 'schedule' || inputs.untagged }}
          delete-tags: ${{ github.event.inputs.tags }}
          use-regex: true
          dry-run: ${{ github.event_name == 'workflow_dispatch' && inputs.dry-run || (github.event_name != 'workflow_dispatch' && 'false') }}