shared-ghcr-cleanup.yaml

name: Shared GHCR package cleanup

on:
  workflow_call:
    inputs:
        runs-on:
            description: >
                The runner to use for the job
            required: false
            default: "default"
            type: string

        owner:
            description: >
                Owner of the package (user or organization). Defaults to project owner
            required: false
            type: string

        repository:
            description: >
                The GitHub repository where the package is stored. Defaults to repository
                name
            required: false
            type: string

        package:
            description: >
                Comma-separated list of packages to cleanup. Support dynamic packages
                (wildcard or regular expression) by enabling the expand-packages option.
            required: false
            type: string
    
        expand-packages:
            description: >
                Enable wildcard or regular expression support on the package(s) option to
                support dynamic package selection. Requires use of a Personal Access Token
                (PAT) for the token value.
            required: false
            type: boolean

        # Cleanup Options

        delete-tags:
            description: >
                Comma-separated list of tags to delete (supports wildcard syntax), can be
                abbreviated as `tags`. A regular expression selector can be used instead
                by setting the `use-regex` option to true
            required: false
            type: string

        exclude-tags:
            description: >
                Comma-separated list of tags strictly to be preserved/excluded from
                deletion (supports wildcard syntax). A regular expression selector can be
                used instead by setting the `use-regex` option to true
            required: false
            type: string

        keep-n-tagged:
            description: >
                Number of tagged images to keep (sorted by date, keeping newest)
            required: false
            type: number

        delete-untagged:
            description: >
                Delete all untagged images. This option is set to true when no other
                delete or keep options are set (true/false)
            required: false
            type: boolean

        delete-ghost-images:
            description: >
                Delete multi architecture images where all underlying platform images are
                missing (true/false) Default: false
            required: false
            type: boolean

        delete-partial-images:
            description: >
                Delete multi architecture images where some (but not all) underlying
                platform images are missing (true/false) Default: false
            required: false
            type: boolean

        delete-orphaned-images:
            description: >
                Delete orphaned images (referrers/cosign etc) where the parent image
                doesn't exist. Uses a tagged based check.
            required: false
            type: boolean

        # Additional Options

        validate:
            description: >
                Validate all multi-architecture images manifests by checking their digests
                are present in the registry (true/false) Default: false
            required: false
            type: boolean

        dry-run:
            description: >
                Simulate action - does not remove any packages (true/false) Default: false
            required: false
            type: boolean      

jobs:
  ghcr-cleanup:
    runs-on: ${{ inputs.runs-on}}
    permissions:
        packages: write
    steps:
      - uses: dataaxiom/ghcr-cleanup-action@v1
        name: ghcr.io cleanup action
        with:
            dry-run: ${{ inputs.dry-run }}
            owner: ${{ inputs.owner }}
            repository: ${{ inputs.repository }}
            package: ${{ inputs.package }}
            expand-packages: ${{ inputs.expand-packages }}
            exclude-tags: ${{ inputs.exclude-tags }}
            delete-untagged: ${{ inputs.delete-untagged }}
            delete-ghost-images: ${{ inputs.delete-ghost-images }}
            delete-orphaned-images: ${{ inputs.delete-orphaned-images }}
            delete-partial-images: ${{ inputs.delete-partial-images }}
            keep-n-tagged: ${{ inputs.keep-n-tagged }}
            validate: ${{ inputs.validate }}
            token: ${{ secrets.GITHUB_TOKEN }}