ci: prune old container registry tags too

Add prune-registry.sh: keeps the moving tag and newest versioned tag per
distro plus their cosign signature tags, deletes the rest via the Gitea
packages API. Wire it into the prune job (uses REGISTRY_TOKEN).

.gitea/workflows/build.yaml

@@ -135,10 +135,20 @@ jobs:
       GITEA_REPO: Misthios/bootc-images
     steps:
       - name: Install tools
-        run: dnf install -y nodejs jq curl
+        run: dnf install -y nodejs jq curl skopeo
       - name: Checkout
         uses: actions/checkout@v4
       - name: Prune old releases
         env:
           RELEASE_TOKEN: ${{ secrets.RELEASE_TOKEN }}
         run: ./prune-releases.sh fedora-cosmic
+      - name: Prune old registry tags
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -xeuo pipefail
+          authfile=/tmp/prune-auth.json
+          echo "${REGISTRY_TOKEN}" | skopeo login -u "${REGISTRY_USERNAME}" \
+            --password-stdin --authfile "${authfile}" git.plabble.org
+          AUTHFILE="${authfile}" ./prune-registry.sh fedora-cosmic Misthios 44 rawhide

prune-registry.sh

@@ -0,0 +1,64 @@
+#!/usr/bin/env bash
+# Prune old container image versions (tags) for an image in the Gitea registry.
+#
+# Keeps the moving tag (e.g. "44") and the newest versioned tag per distro,
+# plus the cosign signature tag (sha256-<digest>.sig) for each kept image.
+#
+# Usage:
+#   REGISTRY_TOKEN=<write:package> REGISTRY_USERNAME=<user> \
+#     ./prune-registry.sh [image] [owner] [distro...]
+set -euo pipefail
+
+IMAGE="${1:-fedora-cosmic}"; shift || true
+OWNER="${1:-Misthios}"; shift || true
+DISTROS=("$@"); [[ ${#DISTROS[@]} -gt 0 ]] || DISTROS=(44 rawhide)
+
+GITEA_URL="${GITEA_URL:-https://git.plabble.org}"
+REGISTRY_HOST="${REGISTRY_HOST:-$(printf '%s' "${GITEA_URL}" | sed -E 's#https?://##')}"
+TOKEN="${REGISTRY_TOKEN:?REGISTRY_TOKEN (write:package) is required}"
+AUTHFILE="${AUTHFILE:-${HOME}/.docker/config.json}"
+API="${GITEA_URL%/}/api/v1/packages/${OWNER}/container/${IMAGE}"
+IMAGE_REF="${REGISTRY_HOST}/${OWNER}/${IMAGE}"
+
+# Collect all versions (paginated).
+versions=""
+page=1
+while :; do
+  page_json="$(curl -fsSL -H "Authorization: token ${TOKEN}" \
+    "${API}?limit=50&page=${page}")" || break
+  [[ "$(jq 'length' <<< "${page_json}")" -eq 0 ]] && break
+  versions+="$(jq -r '.[].version' <<< "${page_json}")"$'\n'
+  page=$((page + 1))
+  [[ "${page}" -gt 40 ]] && break
+done
+
+# Decide what to keep.
+declare -A keep=()
+for d in "${DISTROS[@]}"; do
+  keep["${d}"]=1
+  newest="$(grep -E "^${d}\.[0-9]+\.[0-9]+$" <<< "${versions}" \
+    | sort -t. -k2,2n -k3,3n | tail -1)"
+  [[ -n "${newest}" ]] && keep["${newest}"]=1
+done
+
+# Keep the cosign signature of each kept image tag.
+for tag in "${!keep[@]}"; do
+  [[ "${tag}" == sha256-* ]] && continue
+  digest="$(skopeo inspect --authfile "${AUTHFILE}" --format '{{.Digest}}' \
+    "docker://${IMAGE_REF}:${tag}" 2>/dev/null || true)"
+  [[ -n "${digest}" ]] && keep["sha256-${digest#sha256:}.sig"]=1
+done
+
+# Delete everything else.
+while IFS= read -r v; do
+  [[ -z "${v}" ]] && continue
+  if [[ -n "${keep[${v}]:-}" ]]; then
+    echo "keep   ${v}"
+  else
+    echo "remove ${v}"
+    curl -fsSL -X DELETE -H "Authorization: token ${TOKEN}" \
+      "${API}/${v}" >/dev/null || echo "  (failed to delete ${v})"
+  fi
+done <<< "${versions}"
+
+echo "Pruned ${IMAGE} registry versions."