From 57a30c885951c9b0a5b0af2279866225ff757cba Mon Sep 17 00:00:00 2001 From: Tao Li Date: Thu, 13 Aug 2026 14:10:05 +0800 Subject: [PATCH 1/4] ci: add workflow to cleanup -testing operand image Signed-off-by: Tao Li --- .github/workflows/registry-clean.yml | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 .github/workflows/registry-clean.yml diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml new file mode 100644 index 0000000..0f4e98a --- /dev/null +++ b/.github/workflows/registry-clean.yml @@ -0,0 +1,27 @@ +# This workflow runs daily to clean up the `*-testing` images older than the +# cut-off period specified in `snok/container-retention-policy` +name: clean-testing-package + +on: + workflow_dispatch: + schedule: + - cron: '0 0 * * *' + +env: + IMAGE_NAME: "postgresql-trunk-testing" + +jobs: + clean-ghcr: + name: delete old testing container images + permissions: + packages: write + runs-on: ubuntu-latest + steps: + - name: Delete '-testing' operand images in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + cut-off: 1w + keep-n-most-recent: 1 + account: ${{ github.repository_owner }} + token: ${{ secrets.GITHUB_TOKEN }} From c7f804a504145720efdbbd3e991579a45257bfab Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Wed, 19 Aug 2026 14:09:44 +0200 Subject: [PATCH 2/4] chore: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Niccolò Fei --- .github/workflows/registry-clean.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml index 0f4e98a..036d071 100644 --- a/.github/workflows/registry-clean.yml +++ b/.github/workflows/registry-clean.yml @@ -1,8 +1,9 @@ -# This workflow runs daily to clean up the `*-testing` images older than the -# cut-off period specified in `snok/container-retention-policy` +# This workflow runs daily to clean up the images older than the +# cut-off period specified in `snok/container-retention-policy`. name: clean-testing-package on: + push: workflow_dispatch: schedule: - cron: '0 0 * * *' From 683260231277287ee8a2cbdad2bee97b008b5c46 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Wed, 19 Aug 2026 17:11:11 +0200 Subject: [PATCH 3/4] feat: cleanup production images via filtering MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Niccolò Fei --- .github/workflows/registry-clean.yml | 90 ++++++++++++++++++++++++++-- 1 file changed, 84 insertions(+), 6 deletions(-) diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml index 036d071..e1d0252 100644 --- a/.github/workflows/registry-clean.yml +++ b/.github/workflows/registry-clean.yml @@ -1,28 +1,106 @@ -# This workflow runs daily to clean up the images older than the -# cut-off period specified in `snok/container-retention-policy`. +# This workflow runs daily to clean up images older than the cut-off +# period specified in each `snok/container-retention-policy`. +# +# Both testing and production images are being cleaned up, with separate +# retention policies. +# +# For `postgresql-trunk-testing` images: +# - Delete everything that's older than 1 week +# +# For `postgresql-trunk` images: +# - Delete all rolling-upgrade-e2e tags older than 1 week (these are retags required only by E2Es) +# - Delete `-minimal` images older than 1 week, keeping the most recent tag for each distro +# - Delete `-standard` images older than 1 week, keeping the most recent tag for each distro +# - Delete `-postgis` images older than 1 week, keeping the most recent tag for each distro +# - Delete untagged/orphaned layers older than 1 week +# +# Tags produced by build.yml / build-commitfest.yml are never deleted. +# +# Note: `image-tags` wildcard/negation filters only work with a PAT (packages:delete) +# or a GitHub App token (packages:write) -- GITHUB_TOKEN cannot use them. name: clean-testing-package on: - push: workflow_dispatch: schedule: - cron: '0 0 * * *' +permissions: {} + env: - IMAGE_NAME: "postgresql-trunk-testing" + IMAGE_NAME_TESTING: "postgresql-trunk-testing" + IMAGE_NAME: "postgresql-trunk" + DEBIAN_STABLE: trixie + DEBIAN_OLDSTABLE: bookworm jobs: clean-ghcr: name: delete old testing container images permissions: + contents: read packages: write runs-on: ubuntu-latest steps: - - name: Delete '-testing' operand images in ${{ env.IMAGE_NAME }} + - name: Delete '-testing' operand images in ${{ env.IMAGE_NAME_TESTING }} uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 with: - image-names: ${{ env.IMAGE_NAME }} + image-names: ${{ env.IMAGE_NAME_TESTING }} cut-off: 1w keep-n-most-recent: 1 account: ${{ github.repository_owner }} token: ${{ secrets.GITHUB_TOKEN }} + + - name: Delete old rolling-upgrade-e2e images in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + image-tags: "*rolling-upgrade-e2e*" + tag-selection: tagged + cut-off: 1w + account: ${{ github.repository_owner }} + token: ${{ secrets.CR_PAT }} + + - name: Keep only the latest postgis image per distro in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + image-tags: "*-postgis-${{ env.DEBIAN_STABLE }} *-postgis-${{ env.DEBIAN_OLDSTABLE }}" + tag-selection: tagged + cut-off: 1w + keep-n-most-recent: 1 + account: ${{ github.repository_owner }} + token: ${{ secrets.CR_PAT }} + + - name: Keep only the latest standard image per distro in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + image-tags: "*-standard-${{ env.DEBIAN_STABLE }} *-standard-${{ env.DEBIAN_OLDSTABLE }}" + tag-selection: tagged + cut-off: 1w + keep-n-most-recent: 1 + account: ${{ github.repository_owner }} + token: ${{ secrets.CR_PAT }} + + - name: Keep only the latest minimal image per distro in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + image-tags: "*-minimal-${{ env.DEBIAN_STABLE }} *-minimal-${{ env.DEBIAN_OLDSTABLE }}" + tag-selection: tagged + cut-off: 1w + keep-n-most-recent: 1 + account: ${{ github.repository_owner }} + token: ${{ secrets.CR_PAT }} + + # Runs last and only considers untagged versions (dangling SBOM/provenance + # attestation manifests, orphaned layers), independently of the tag rules + # above -- image-tags does not apply to untagged versions. + - name: Delete dangling untagged images in ${{ env.IMAGE_NAME }} + uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 + with: + image-names: ${{ env.IMAGE_NAME }} + tag-selection: untagged + cut-off: 1w + account: ${{ github.repository_owner }} + token: ${{ secrets.CR_PAT }} From e49fa2f4a3ec5c5e154a3482d55daaa8b8e3dc6c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Niccol=C3=B2=20Fei?= Date: Fri, 21 Aug 2026 12:19:56 +0200 Subject: [PATCH 4/4] chore: use GH_TOKEN MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Niccolò Fei --- .github/workflows/registry-clean.yml | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml index e1d0252..e00df4f 100644 --- a/.github/workflows/registry-clean.yml +++ b/.github/workflows/registry-clean.yml @@ -15,9 +15,6 @@ # - Delete untagged/orphaned layers older than 1 week # # Tags produced by build.yml / build-commitfest.yml are never deleted. -# -# Note: `image-tags` wildcard/negation filters only work with a PAT (packages:delete) -# or a GitHub App token (packages:write) -- GITHUB_TOKEN cannot use them. name: clean-testing-package on: @@ -58,7 +55,7 @@ jobs: tag-selection: tagged cut-off: 1w account: ${{ github.repository_owner }} - token: ${{ secrets.CR_PAT }} + token: ${{ secrets.GITHUB_TOKEN }} - name: Keep only the latest postgis image per distro in ${{ env.IMAGE_NAME }} uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 @@ -69,7 +66,7 @@ jobs: cut-off: 1w keep-n-most-recent: 1 account: ${{ github.repository_owner }} - token: ${{ secrets.CR_PAT }} + token: ${{ secrets.GITHUB_TOKEN }} - name: Keep only the latest standard image per distro in ${{ env.IMAGE_NAME }} uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 @@ -80,7 +77,7 @@ jobs: cut-off: 1w keep-n-most-recent: 1 account: ${{ github.repository_owner }} - token: ${{ secrets.CR_PAT }} + token: ${{ secrets.GITHUB_TOKEN }} - name: Keep only the latest minimal image per distro in ${{ env.IMAGE_NAME }} uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0 @@ -91,7 +88,7 @@ jobs: cut-off: 1w keep-n-most-recent: 1 account: ${{ github.repository_owner }} - token: ${{ secrets.CR_PAT }} + token: ${{ secrets.GITHUB_TOKEN }} # Runs last and only considers untagged versions (dangling SBOM/provenance # attestation manifests, orphaned layers), independently of the tag rules @@ -103,4 +100,4 @@ jobs: tag-selection: untagged cut-off: 1w account: ${{ github.repository_owner }} - token: ${{ secrets.CR_PAT }} + token: ${{ secrets.GITHUB_TOKEN }}