retention-plan.yml

name: Retention plan notice

# Monthly artifact retention notice: generates the pruning plan for
# every configured repo, commits it to the tamper-evident plans repo,
# and posts the Slack notice that starts the grace-period clock.
# Nothing is ever deleted from this workflow; the plan's not_before
# field is what the (separate) deletion step later enforces.

on:
  schedule:
    - cron: '0 6 1 * *'  # 06:00 UTC on the 1st of every month
  workflow_dispatch:
    inputs:
      grace_days:
        description: 'Days until not_before (use 90 for the policy launch run)'
        type: string
        required: false
        default: '30'

concurrency:
  group: retention-plan
  cancel-in-progress: false

# GITHUB_TOKEN stays read-only: the push to the plans repo uses the app
# token, which is the only allowed writer there.
permissions:
  contents: read

jobs:
  plan:
    runs-on: ubuntu-24.04
    steps:
      - name: Generate GitHub App token
        id: app-token
        uses: actions/create-github-app-token@d72941d797fd3113feb6b93fd0dec494b13a2547 # v1
        with:
          app-id: ${{ secrets.PROBE_APP_ID }}
          private-key: ${{ secrets.PROBE_APP_PRIVATE_KEY }}
          owner: TykTechnologies
          repositories: artifact-retention-plans,tyk-docs
          permission-contents: write
          permission-pull-requests: write

      - name: Checkout gromit
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          persist-credentials: false

      # Credentials stay persisted on purpose (checkout is v4): the
      # commit step below pushes to this checkout, and nothing here is
      # uploaded as an artifact.
      - name: Checkout plans repo
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # zizmor: ignore[artipacked]
        with:
          repository: TykTechnologies/artifact-retention-plans
          token: ${{ steps.app-token.outputs.token }}
          path: plans-repo

      - name: Set up Go
        uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
        with:
          go-version-file: go.mod

      - name: Generate plan
        env:
          PACKAGECLOUD_TOKEN: ${{ secrets.PACKAGECLOUD_TOKEN }}
          GRACE_DAYS: ${{ inputs.grace_days || '30' }}
        run: |
          REPOS=$(yq '.pkgs | keys | join(" ")' config/config.yaml)
          # shellcheck disable=SC2086 # repos is deliberately word-split
          go run . pkgs plan --json --grace-days "$GRACE_DAYS" $REPOS > plan.json
          # shellcheck disable=SC2086
          go run . pkgs plan --grace-days "$GRACE_DAYS" $REPOS > plan.txt

      # One released file is indexed once per distro version on
      # Packagecloud, so entry counts run ~10x higher than file counts;
      # checksums identify the underlying files. Newly eligible =
      # checksums in this plan that were not in the previous committed
      # plan. Only these trigger the Slack notice.
      - name: Diff against previous plan
        id: diff
        run: |
          jq -r '.[].packages[]?.sha256sum' plan.json | sort -u > current.shas
          prev=$(ls plans-repo/plans/*/plan.json 2>/dev/null | sort | tail -1 || true)
          if [ -n "$prev" ]; then
            jq -r '.[].packages[]?.sha256sum' "$prev" | sort -u > previous.shas
          else
            : > previous.shas
          fi
          comm -23 current.shas previous.shas > new.shas
          echo "new_count=$(wc -l < new.shas | tr -d ' ')" >> "$GITHUB_OUTPUT"
          echo "total_files=$(wc -l < current.shas | tr -d ' ')" >> "$GITHUB_OUTPUT"
          echo "total_pruned=$(jq '[.[].pruned] | add' plan.json)" >> "$GITHUB_OUTPUT"
          echo "total_gib=$(jq '[.[].pruned_bytes] | add / 1073741824 * 10 | round / 10' plan.json)" >> "$GITHUB_OUTPUT"
          echo "not_before=$(jq -r '.[0].not_before[:10]' plan.json)" >> "$GITHUB_OUTPUT"

      - name: Commit plan to plans repo
        id: commit
        env:
          RUN_URL: ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}
        run: |
          month=$(date -u +%Y-%m)
          mkdir -p "plans-repo/plans/$month"
          cp plan.json plan.txt "plans-repo/plans/$month/"
          cd plans-repo
          git config user.name "gromit-retention"
          git config user.email "gromit-retention@users.noreply.github.com"
          git add "plans/$month"
          if git diff --cached --quiet; then
            echo "plan unchanged since last commit"
          else
            git commit -m "Retention plan $month" -m "Generated by $RUN_URL"
            git push
          fi
          echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"

      - name: Summarise
        env:
          NEW_COUNT: ${{ steps.diff.outputs.new_count }}
          COMMIT: ${{ steps.commit.outputs.sha }}
        run: |
          {
            echo "## Retention plan"
            echo ""
            echo "| Repo | Packages | Retained | Pruned | Pruned GiB | Not before |"
            echo "|------|----------|----------|--------|------------|------------|"
            jq -r '.[] | "| \(.repo) | \(.retained + .pruned) | \(.retained) | \(.pruned) | \(.pruned_bytes / 1073741824 * 10 | round / 10) | \(.not_before[:10]) |"' plan.json
            echo ""
            echo "$NEW_COUNT files newly eligible since the previous plan."
            echo "Committed as [\`$COMMIT\`](https://github.com/TykTechnologies/artifact-retention-plans/commit/$COMMIT)."
            echo ""
            echo "Nothing was deleted by this workflow."
          } >> "$GITHUB_STEP_SUMMARY"

      # No PR is opened when the table is unchanged
      - name: Checkout tyk-docs
        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
        with:
          repository: TykTechnologies/tyk-docs
          token: ${{ steps.app-token.outputs.token }}
          path: tyk-docs
          persist-credentials: false

      - name: Render retired-versions snippet
        run: go run . pkgs retirement --plan plan.json > tyk-docs/snippets/retired-versions.mdx

      - name: PR the snippet to tyk-docs
        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          token: ${{ steps.app-token.outputs.token }}
          path: tyk-docs
          branch: gromit/retired-versions
          delete-branch: true
          commit-message: 'Update retired versions table'
          title: 'Update retired versions table'
          body: |
            Regenerated from the latest [retention plan](https://github.com/TykTechnologies/artifact-retention-plans/commit/${{ steps.commit.outputs.sha }}) by [this run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}).

            The table in `snippets/retired-versions.mdx` reflects the retention cutoffs the pruning run will enforce.

      - name: Slack notice
        if: steps.diff.outputs.new_count != '0'
        uses: slackapi/slack-github-action@af78098f536edbc4de71162a307590698245be95 # v3.0.1
        with:
          method: chat.postMessage
          token: ${{ secrets.SLACK_BOT_TOKEN }}
          payload: |
            {
              "channel": "${{ secrets.RETENTION_SLACK_CHANNEL }}",
              "blocks": [
                {
                  "type": "section",
                  "text": {
                    "type": "mrkdwn",
                    "text": "*Artifact retention plan published* — @support-team\n${{ steps.diff.outputs.new_count }} files are newly eligible for pruning since the last plan. In total ${{ steps.diff.outputs.total_files }} files are eligible, which appear as ${{ steps.diff.outputs.total_pruned }} package listings on Packagecloud (one per distro version, ${{ steps.diff.outputs.total_gib }} GiB). Nothing will be deleted before *${{ steps.diff.outputs.not_before }}*.\n<https://github.com/TykTechnologies/artifact-retention-plans/commit/${{ steps.commit.outputs.sha }}|Review the committed plan>"
                  }
                }
              ]
            }