Skip to content

Add GHCR cleanup workflow to delete old container images #3136

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
AnjaliMishra1st wants to merge 8 commits into
base: main
Choose a base branch
from
+64 −0
Open

Add GHCR cleanup workflow to delete old container images #3136

Changes from 5 commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
0b4210f
Add GHCR cleanup workflow to delete old container images
AnjaliMishra1st Mar 20, 2026
38a6b8c
Update cleanup schedule and increase versions to keep
AnjaliMishra1st Mar 20, 2026
e049c7a
Add ignore-versions parameter to cleanup workflow
AnjaliMishra1st Apr 5, 2026
10dec94
Update cleanup-ghcr.yml
AnjaliMishra1st Apr 9, 2026
ce49913
Merge branch 'main' into patch-1
puckpuck Apr 9, 2026
c7d6103
Refactor dry-run input and update cleanup logic
AnjaliMishra1st Apr 10, 2026
fc73ba1
Potential fix for pull request finding
AnjaliMishra1st Apr 10, 2026
f4612e5
Update cleanup-ghcr.yml
AnjaliMishra1st Apr 10, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
62 changes: 62 additions & 0 deletions .github/workflows/cleanup-ghcr.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,62 @@
name: Cleanup GHCR Images

on:
schedule:
- cron: '0 3 * * 0'
workflow_dispatch:
Comment on lines +6 to +9
inputs:
dry_run: # changed from dry-run → dry_run
description: "Run in dry-run mode (no deletion)"
required: false
default: "true"

jobs:
cleanup:
runs-on: ubuntu-latest

steps:
- name: Checkout repository
uses: actions/checkout@v3
Copy link
Copy Markdown
Member

@Kielek Kielek Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

All other GH actions pins versions to the exact commit + tag comment.
It should be applied also here.

Copy link
Copy Markdown
Author

@AnjaliMishra1st AnjaliMishra1st Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, I’ve updated this to use a pinned commit SHA and added a version comment for consistency with other workflows.

Copy link
Copy Markdown
Member

@Kielek Kielek Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After hash add some comment related to version, see other files


- name: Install GitHub CLI
run: sudo apt-get update && sudo apt-get install gh -y
Copy link
Copy Markdown
Member

@Kielek Kielek Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

are you sure that it is needed? I think that GitHub CLI should be available by default on all-defualt runmers.

Copy link
Copy Markdown
Author

@AnjaliMishra1st AnjaliMishra1st Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You're right, I’ve removed the installation step since GitHub CLI is already available on default runners.


- name: Authenticate GitHub CLI
run: echo "${{ secrets.GITHUB_TOKEN }}" | gh auth login --with-token
Copy link
Copy Markdown
Member

@Kielek Kielek Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that this one is also not-necessary. In OTel .NET repository there is usage of gh-cli, but there is no need to login.

Copy link
Copy Markdown
Author

@AnjaliMishra1st AnjaliMishra1st Apr 10, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for pointing this out, removed the unnecessary authentication step.


- name: List and clean nightly images
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
DRY_RUN: ${{ github.event.inputs.dry_run || 'true' }} # ✅ fixed
run: |
echo "Dry run mode: $DRY_RUN"

versions=$(gh api \
-H "Accept: application/vnd.github+json" \
/orgs/open-telemetry/packages/container/otel-demo/versions \
--jq '.[].id')
Comment on lines +34 to +38

for version in $versions; do
tags=$(gh api \
-H "Accept: application/vnd.github+json" \
/orgs/open-telemetry/packages/container/otel-demo/versions/$version \
--jq '.metadata.container.tags[]')

for tag in $tags; do
if [[ "$tag" == nightly-* ]]; then
echo "Found nightly image: $tag (version: $version)"

if [ "$DRY_RUN" = "true" ]; then
echo "[DRY RUN] Would delete version ID: $version"
else
echo "Deleting version ID: $version"
gh api --method DELETE \
-H "Accept: application/vnd.github+json" \
/orgs/open-telemetry/packages/container/otel-demo/versions/$version
fi
else
Comment on lines +34 to +60
echo "Skipping non-nightly tag: $tag"
fi
done
done

Loading