From e4251f4d783acc8b0e11ac7eb741fd1989d5b4de Mon Sep 17 00:00:00 2001
From: Wesley van Tilburg <justwesley@protonmail.com>
Date: Sun, 27 Sep 2026 20:28:40 +0200
Subject: [PATCH] ci: fix prune-registry registry ref case and protect
 signatures

The registry path is lowercase, so the capitalized owner made skopeo inspect
fail and every cosign .sig tag was deleted. Lowercase the owner and, if no
digest resolves, keep all signature tags instead of deleting them.
---
 prune-registry.sh | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/prune-registry.sh b/prune-registry.sh
index 862fbe5..2821973 100755
--- a/prune-registry.sh
+++ b/prune-registry.sh
@@ -18,7 +18,8 @@ REGISTRY_HOST="${REGISTRY_HOST:-$(printf '%s' "${GITEA_URL}" | sed -E 's#https?:
 TOKEN="${REGISTRY_TOKEN:?REGISTRY_TOKEN (write:package) is required}"
 AUTHFILE="${AUTHFILE:-${HOME}/.docker/config.json}"
 API="${GITEA_URL%/}/api/v1/packages/${OWNER}/container/${IMAGE}"
-IMAGE_REF="${REGISTRY_HOST}/${OWNER}/${IMAGE}"
+# Registry paths are lowercase (the Gitea API owner is not).
+IMAGE_REF="${REGISTRY_HOST}/$(printf '%s' "${OWNER}" | tr '[:upper:]' '[:lower:]')/${IMAGE}"
 
 # Collect all versions (paginated).
 versions=""
@@ -41,13 +42,24 @@ for d in "${DISTROS[@]}"; do
   [[ -n "${newest}" ]] && keep["${newest}"]=1
 done
 
-# Keep the cosign signature of each kept image tag.
+# Keep the cosign signature of each kept image tag. If no digest could be
+# resolved, keep every signature tag rather than risk deleting a needed one.
+resolved=0
 for tag in "${!keep[@]}"; do
   [[ "${tag}" == sha256-* ]] && continue
   digest="$(skopeo inspect --authfile "${AUTHFILE}" --format '{{.Digest}}' \
     "docker://${IMAGE_REF}:${tag}" 2>/dev/null || true)"
-  [[ -n "${digest}" ]] && keep["sha256-${digest#sha256:}.sig"]=1
+  if [[ -n "${digest}" ]]; then
+    keep["sha256-${digest#sha256:}.sig"]=1
+    resolved=1
+  fi
 done
+if [[ "${resolved}" -eq 0 ]]; then
+  echo "WARNING: could not resolve any image digest; keeping all signature tags"
+  while IFS= read -r v; do
+    [[ "${v}" == sha256-* ]] && keep["${v}"]=1
+  done <<< "${versions}"
+fi
 
 # Delete everything else.
 while IFS= read -r v; do