Skip to content

GHCR Cleanup

GHCR Cleanup #20

Workflow file for this run

name: GHCR Cleanup
on:
schedule:
- cron: "0 3 * * 0" # Sundays at 03:00 UTC
workflow_dispatch:
concurrency:
group: ghcr-cleanup
cancel-in-progress: false
permissions: {}
jobs:
prune-sha-tags:
name: Prune old sha-* tags
runs-on: ubuntu-latest
timeout-minutes: 15
permissions:
packages: write
strategy:
matrix:
package:
- apollon/webapp
- apollon/server
steps:
- name: Delete stale sha-tagged versions
# v3.1.0 accepts GitHub's current installation-token format and
# automatically protects the child manifests of retained multi-arch images.
uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
with:
account: ls1intum
token: ${{ secrets.GITHUB_TOKEN }}
image-names: ${{ matrix.package }}
# Release images are protected by both the explicit !v* !*.*.*
# negations and the action's multi-tag rule (a digest carrying
# any non-matching tag is refused).
image-tags: "sha-* !v* !*.*.*"
tag-selection: tagged
cut-off: 30d
keep-n-most-recent: 20