feat: purge scripts for CI/CD artifacts
This commit is contained in:
Eric Gullickson
91
scripts/ci/purge-action-runs.sh
Executable file
91
scripts/ci/purge-action-runs.sh
Executable file
@@ -0,0 +1,91 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# Defaults (override via CLI flags)
|
||||||
|
GITEA_BASE_URL="https://git.motovaultpro.com"
|
||||||
|
TOKEN=""
|
||||||
|
OWNER="egullickson"
|
||||||
|
REPO="motovaultpro"
|
||||||
|
PER_PAGE=50
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$0 --token=YOUR_TOKEN [--base-url=https://git.motovaultpro.com] [--owner=egullickson] [--repo=motovaultpro] [--per-page=50]
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
# Delete all Actions runs in egullickson/motovaultpro
|
||||||
|
$0 --token=XXXX
|
||||||
|
|
||||||
|
# Different repo
|
||||||
|
$0 --token=XXXX --owner=someone --repo=otherrepo
|
||||||
|
|
||||||
|
# Different server + page size
|
||||||
|
$0 --token=XXXX --base-url=https://git.example.com --per-page=100
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- CLI parsing ---
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
--token=*) TOKEN="${arg#*=}" ;;
|
||||||
|
--base-url=*) GITEA_BASE_URL="${arg#*=}" ;;
|
||||||
|
--owner=*) OWNER="${arg#*=}" ;;
|
||||||
|
--repo=*) REPO="${arg#*=}" ;;
|
||||||
|
--per-page=*) PER_PAGE="${arg#*=}" ;;
|
||||||
|
-h|--help) usage; exit 0 ;;
|
||||||
|
*)
|
||||||
|
echo "ERROR: Unknown argument: $arg"
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN" ]]; then
|
||||||
|
echo "ERROR: --token= is required"
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
# Basic validation
|
||||||
|
if ! [[ "$PER_PAGE" =~ ^[0-9]+$ ]]; then
|
||||||
|
echo "ERROR: --per-page must be a number"
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
api() {
|
||||||
|
curl -fsS \
|
||||||
|
-H "Authorization: token ${TOKEN}" \
|
||||||
|
-H "Accept: application/json" \
|
||||||
|
"$@"
|
||||||
|
}
|
||||||
|
|
||||||
|
page=1
|
||||||
|
deleted=0
|
||||||
|
|
||||||
|
while :; do
|
||||||
|
echo "Fetching page ${page}..."
|
||||||
|
json="$(api "${GITEA_BASE_URL}/api/v1/repos/${OWNER}/${REPO}/actions/runs?limit=${PER_PAGE}&page=${page}")"
|
||||||
|
|
||||||
|
# Try both common shapes:
|
||||||
|
# - {"workflow_runs":[...]}
|
||||||
|
# - {"runs":[...]}
|
||||||
|
ids="$(echo "$json" | jq -r '(.workflow_runs // .runs // []) | .[].id')"
|
||||||
|
|
||||||
|
if [[ -z "${ids}" ]]; then
|
||||||
|
echo "No more runs found."
|
||||||
|
break
|
||||||
|
fi
|
||||||
|
|
||||||
|
while read -r id; do
|
||||||
|
[[ -z "$id" ]] && continue
|
||||||
|
echo "Deleting run id=${id}"
|
||||||
|
api -X DELETE "${GITEA_BASE_URL}/api/v1/repos/${OWNER}/${REPO}/actions/runs/${id}" >/dev/null
|
||||||
|
deleted=$((deleted + 1))
|
||||||
|
done <<< "${ids}"
|
||||||
|
|
||||||
|
page=$((page + 1))
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Done. Deleted ${deleted} runs."
|
||||||
191
scripts/ci/purge-container-images.sh
Executable file
191
scripts/ci/purge-container-images.sh
Executable file
@@ -0,0 +1,191 @@
|
|||||||
|
#!/usr/bin/env bash
|
||||||
|
set -euo pipefail
|
||||||
|
|
||||||
|
# =============================================================================
|
||||||
|
# Defaults (override via CLI flags)
|
||||||
|
# =============================================================================
|
||||||
|
REGISTRY="https://git.motovaultpro.com"
|
||||||
|
USERNAME="egullickson"
|
||||||
|
TOKEN=""
|
||||||
|
KEEP_TAG="latest"
|
||||||
|
DRY_RUN=1
|
||||||
|
|
||||||
|
REPOS=(
|
||||||
|
"egullickson/frontend"
|
||||||
|
"egullickson/backend"
|
||||||
|
)
|
||||||
|
# =============================================================================
|
||||||
|
|
||||||
|
need() { command -v "$1" >/dev/null || { echo "ERROR: missing dependency: $1"; exit 1; }; }
|
||||||
|
need curl
|
||||||
|
need jq
|
||||||
|
|
||||||
|
usage() {
|
||||||
|
cat <<EOF
|
||||||
|
Usage:
|
||||||
|
$0 --token=YOUR_PAT [--user=egullickson] [--registry=https://git.motovaultpro.com]
|
||||||
|
[--keep-tag=latest] [--dry-run|--no-dry-run]
|
||||||
|
|
||||||
|
Examples:
|
||||||
|
# Preview
|
||||||
|
$0 --token=XXXX --dry-run
|
||||||
|
|
||||||
|
# Actually delete
|
||||||
|
$0 --token=XXXX --no-dry-run
|
||||||
|
|
||||||
|
Notes:
|
||||||
|
- Deletes all tags except KEEP_TAG for repos:
|
||||||
|
${REPOS[*]}
|
||||||
|
- Protects KEEP_TAG by digest (won't delete anything pointing to KEEP_TAG digest).
|
||||||
|
EOF
|
||||||
|
}
|
||||||
|
|
||||||
|
# --- CLI parsing -------------------------------------------------------------
|
||||||
|
for arg in "$@"; do
|
||||||
|
case "$arg" in
|
||||||
|
--token=*) TOKEN="${arg#*=}" ;;
|
||||||
|
--user=*) USERNAME="${arg#*=}" ;;
|
||||||
|
--registry=*) REGISTRY="${arg#*=}" ;;
|
||||||
|
--keep-tag=*) KEEP_TAG="${arg#*=}" ;;
|
||||||
|
--dry-run) DRY_RUN=1 ;;
|
||||||
|
--no-dry-run) DRY_RUN=0 ;;
|
||||||
|
-h|--help) usage; exit 0 ;;
|
||||||
|
*)
|
||||||
|
echo "ERROR: Unknown argument: $arg"
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
;;
|
||||||
|
esac
|
||||||
|
done
|
||||||
|
|
||||||
|
if [[ -z "$TOKEN" ]]; then
|
||||||
|
echo "ERROR: --token= is required"
|
||||||
|
usage
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
|
||||||
|
ACCEPT_MANIFEST="application/vnd.oci.image.manifest.v1+json, application/vnd.oci.image.index.v1+json, application/vnd.docker.distribution.manifest.v2+json"
|
||||||
|
|
||||||
|
get_bearer_token() {
|
||||||
|
local repo="$1"
|
||||||
|
local scope="repository:${repo}:pull,delete"
|
||||||
|
curl -fsS -u "${USERNAME}:${TOKEN}" \
|
||||||
|
"${REGISTRY}/v2/token?service=container_registry&scope=${scope}" \
|
||||||
|
| jq -r '.token // .access_token // empty'
|
||||||
|
}
|
||||||
|
|
||||||
|
auth_header_for_repo() {
|
||||||
|
local repo="$1"
|
||||||
|
local t
|
||||||
|
t="$(get_bearer_token "$repo")"
|
||||||
|
if [[ -z "$t" ]]; then
|
||||||
|
echo "ERROR: Could not obtain bearer token for ${repo} (check PAT permissions)."
|
||||||
|
exit 1
|
||||||
|
fi
|
||||||
|
echo "Authorization: Bearer ${t}"
|
||||||
|
}
|
||||||
|
|
||||||
|
tags_list() {
|
||||||
|
local repo="$1" auth="$2"
|
||||||
|
curl -fsS -H "$auth" "${REGISTRY}/v2/${repo}/tags/list"
|
||||||
|
}
|
||||||
|
|
||||||
|
digest_for_tag() {
|
||||||
|
local repo="$1" tag="$2" auth="$3"
|
||||||
|
curl -fsSI \
|
||||||
|
-H "$auth" \
|
||||||
|
-H "Accept: ${ACCEPT_MANIFEST}" \
|
||||||
|
"${REGISTRY}/v2/${repo}/manifests/${tag}" \
|
||||||
|
| tr -d '\r' \
|
||||||
|
| awk 'BEGIN{IGNORECASE=1} /^docker-content-digest:/ {print $2; exit}'
|
||||||
|
}
|
||||||
|
|
||||||
|
delete_digest() {
|
||||||
|
local repo="$1" digest="$2" auth="$3"
|
||||||
|
if [[ "$DRY_RUN" == "1" ]]; then
|
||||||
|
echo "DRY_RUN: DELETE ${REGISTRY}/v2/${repo}/manifests/${digest}"
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
curl -fsS -X DELETE -H "$auth" \
|
||||||
|
"${REGISTRY}/v2/${repo}/manifests/${digest}" >/dev/null
|
||||||
|
}
|
||||||
|
|
||||||
|
purge_repo_keep_tag() {
|
||||||
|
local repo="$1"
|
||||||
|
echo "== Purging ${repo} (keep ${KEEP_TAG}) =="
|
||||||
|
|
||||||
|
local auth
|
||||||
|
auth="$(auth_header_for_repo "$repo")"
|
||||||
|
|
||||||
|
local json tags
|
||||||
|
json="$(tags_list "$repo" "$auth")"
|
||||||
|
tags="$(echo "$json" | jq -r '.tags[]?' | sort || true)"
|
||||||
|
|
||||||
|
if [[ -z "$tags" ]]; then
|
||||||
|
echo "No tags found."
|
||||||
|
echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
if ! echo "$tags" | grep -qx "${KEEP_TAG}"; then
|
||||||
|
echo "WARN: No '${KEEP_TAG}' tag found; refusing to purge ${repo}."
|
||||||
|
echo "$tags" | sed 's/^/ - /'
|
||||||
|
echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
local keep_digest
|
||||||
|
keep_digest="$(digest_for_tag "$repo" "$KEEP_TAG" "$auth" || true)"
|
||||||
|
if [[ -z "$keep_digest" ]]; then
|
||||||
|
echo "ERROR: Could not resolve digest for ${repo}:${KEEP_TAG}"
|
||||||
|
echo "Tip: curl -vI -H \"$auth\" ${REGISTRY}/v2/${repo}/manifests/${KEEP_TAG}"
|
||||||
|
echo
|
||||||
|
return 1
|
||||||
|
fi
|
||||||
|
echo "${KEEP_TAG} digest: ${keep_digest}"
|
||||||
|
|
||||||
|
# Collect digests referenced by non-KEEP_TAG tags (skipping those equal to keep_digest)
|
||||||
|
local digests=()
|
||||||
|
while read -r tag; do
|
||||||
|
[[ -z "$tag" || "$tag" == "$KEEP_TAG" ]] && continue
|
||||||
|
|
||||||
|
local d
|
||||||
|
d="$(digest_for_tag "$repo" "$tag" "$auth" || true)"
|
||||||
|
if [[ -z "$d" ]]; then
|
||||||
|
echo "WARN: couldn't resolve digest for tag=${tag} (skipping)"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
if [[ "$d" == "$keep_digest" ]]; then
|
||||||
|
echo "SKIP: tag=${tag} points to ${KEEP_TAG} digest (deleting would remove ${KEEP_TAG} too)"
|
||||||
|
continue
|
||||||
|
fi
|
||||||
|
|
||||||
|
digests+=("$d")
|
||||||
|
done <<< "$tags"
|
||||||
|
|
||||||
|
if [[ "${#digests[@]}" -eq 0 ]]; then
|
||||||
|
echo "Nothing to delete."
|
||||||
|
echo
|
||||||
|
return 0
|
||||||
|
fi
|
||||||
|
|
||||||
|
echo "Will delete (deduped) manifest(s) (and all tags pointing to them)."
|
||||||
|
printf '%s\n' "${digests[@]}" | sort -u | while read -r digest; do
|
||||||
|
[[ -z "$digest" ]] && continue
|
||||||
|
echo "Deleting digest: $digest"
|
||||||
|
if ! delete_digest "$repo" "$digest" "$auth"; then
|
||||||
|
echo "WARN: delete failed for $digest"
|
||||||
|
fi
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Done."
|
||||||
|
echo
|
||||||
|
}
|
||||||
|
|
||||||
|
for repo in "${REPOS[@]}"; do
|
||||||
|
purge_repo_keep_tag "$repo"
|
||||||
|
done
|
||||||
|
|
||||||
|
echo "Complete."
|
||||||
Reference in New Issue
Block a user