This repository was archived by the owner on Sep 14, 2026. It is now read-only.
ci: bound Actions artifact retention #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Private GHCR canary | |
| on: | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| probe: | |
| name: Publish inert probe | |
| if: ${{ github.event_name != 'pull_request' || (github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]') }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 10 | |
| permissions: | |
| contents: read | |
| packages: write | |
| steps: | |
| - name: Set up ORAS 1.3.3 | |
| uses: oras-project/setup-oras@1d808f7d7f6995cc68b7bf507bfe5c5446e1dc9d | |
| with: | |
| version: 1.3.3 | |
| - name: Publish inert probe | |
| id: probe | |
| env: | |
| GHCR_TOKEN: ${{ github.token }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| owner="${GITHUB_REPOSITORY_OWNER,,}" | |
| repository="${GITHUB_REPOSITORY#*/}" | |
| package="${repository,,}-ci-artifacts" | |
| tag="probe-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}" | |
| reference="ghcr.io/${owner}/${package}:${tag}" | |
| probe_dir="$(mktemp -d)" | |
| registry_config="${probe_dir}/registry.json" | |
| cleanup() { | |
| oras logout ghcr.io --registry-config "${registry_config}" >/dev/null 2>&1 || true | |
| rm -rf -- "${probe_dir}" | |
| } | |
| trap cleanup EXIT | |
| printf 'repository=%s\nrun_id=%s\nrun_attempt=%s\n' \ | |
| "${GITHUB_REPOSITORY}" "${GITHUB_RUN_ID}" "${GITHUB_RUN_ATTEMPT}" \ | |
| > "${probe_dir}/probe.txt" | |
| printf '%s' "${GHCR_TOKEN}" | oras login ghcr.io \ | |
| --username "${GITHUB_ACTOR}" \ | |
| --password-stdin \ | |
| --registry-config "${registry_config}" | |
| digest="$( | |
| cd "${probe_dir}" | |
| oras push "${reference}" \ | |
| --registry-config "${registry_config}" \ | |
| --artifact-type application/vnd.krotname.ci-canary.v1 \ | |
| --annotation "org.opencontainers.image.source=${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}" \ | |
| --annotation "org.opencontainers.image.revision=${GITHUB_HEAD_SHA:-${GITHUB_SHA}}" \ | |
| --format go-template \ | |
| --template '{{.digest}}' \ | |
| "probe.txt:text/plain" | |
| )" | |
| { | |
| echo "package=${package}" | |
| echo "reference=${reference}" | |
| echo "digest=${digest}" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Verify private package state | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b | |
| env: | |
| PACKAGE_NAME: ${{ steps.probe.outputs.package }} | |
| PACKAGE_REFERENCE: ${{ steps.probe.outputs.reference }} | |
| PACKAGE_DIGEST: ${{ steps.probe.outputs.digest }} | |
| with: | |
| github-token: ${{ github.token }} | |
| script: | | |
| const response = await github.request( | |
| 'GET /user/packages/{package_type}/{package_name}', | |
| { | |
| package_type: 'container', | |
| package_name: process.env.PACKAGE_NAME, | |
| headers: { 'X-GitHub-Api-Version': '2022-11-28' }, | |
| }, | |
| ); | |
| const packageInfo = response.data; | |
| const expectedOwner = context.repo.owner.toLowerCase(); | |
| if ( | |
| packageInfo.name !== process.env.PACKAGE_NAME | |
| || packageInfo.visibility !== 'private' | |
| || packageInfo.owner?.login?.toLowerCase() !== expectedOwner | |
| ) { | |
| throw new Error( | |
| `Unexpected package state: name=${packageInfo.name}, visibility=${packageInfo.visibility}, ` | |
| + `owner=${packageInfo.owner?.login ?? 'unknown'}`, | |
| ); | |
| } | |
| await core.summary | |
| .addHeading('Private GHCR canary', 3) | |
| .addList([ | |
| `Visibility: ${packageInfo.visibility}`, | |
| `Owner: ${packageInfo.owner?.login}`, | |
| `Reference: ${process.env.PACKAGE_REFERENCE}@${process.env.PACKAGE_DIGEST}`, | |
| ]) | |
| .write(); | |
| - name: Remove a public probe-only package | |
| if: ${{ failure() }} | |
| uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b | |
| with: | |
| github-token: ${{ github.token }} | |
| script: | | |
| const packageName = `${context.repo.repo.toLowerCase()}-ci-artifacts`; | |
| const packageResponse = await github.request( | |
| 'GET /user/packages/{package_type}/{package_name}', | |
| { | |
| package_type: 'container', | |
| package_name: packageName, | |
| headers: { 'X-GitHub-Api-Version': '2022-11-28' }, | |
| }, | |
| ); | |
| const packageInfo = packageResponse.data; | |
| const versions = await github.paginate( | |
| 'GET /user/packages/{package_type}/{package_name}/versions', | |
| { | |
| package_type: 'container', | |
| package_name: packageName, | |
| per_page: 100, | |
| headers: { 'X-GitHub-Api-Version': '2022-11-28' }, | |
| }, | |
| ); | |
| const probeOnly = versions.length > 0 && versions.every((version) => { | |
| const tags = version.metadata?.container?.tags ?? []; | |
| return tags.length > 0 && tags.every((tag) => /^probe-\d+-\d+$/.test(tag)); | |
| }); | |
| if ( | |
| packageInfo.name !== packageName | |
| || packageInfo.visibility !== 'public' | |
| || packageInfo.owner?.login?.toLowerCase() !== context.repo.owner.toLowerCase() | |
| || !probeOnly | |
| ) { | |
| throw new Error(`Refusing to delete non-probe package ${packageName}`); | |
| } | |
| await github.request( | |
| 'DELETE /user/packages/{package_type}/{package_name}', | |
| { | |
| package_type: 'container', | |
| package_name: packageName, | |
| headers: { 'X-GitHub-Api-Version': '2022-11-28' }, | |
| }, | |
| ); | |
| core.notice(`Deleted public probe-only package ${packageName}`); |