Misthios
a789cb6669
Add prune-registry.sh: keeps the moving tag and newest versioned tag per distro plus their cosign signature tags, deletes the rest via the Gitea packages API. Wire it into the prune job (uses REGISTRY_TOKEN).
65 lines
2.2 KiB
Bash
65 lines
2.2 KiB
Bash
#!/usr/bin/env bash
|
|
# Prune old container image versions (tags) for an image in the Gitea registry.
|
|
#
|
|
# Keeps the moving tag (e.g. "44") and the newest versioned tag per distro,
|
|
# plus the cosign signature tag (sha256-<digest>.sig) for each kept image.
|
|
#
|
|
# Usage:
|
|
# REGISTRY_TOKEN=<write:package> REGISTRY_USERNAME=<user> \
|
|
# ./prune-registry.sh [image] [owner] [distro...]
|
|
set -euo pipefail
|
|
|
|
IMAGE="${1:-fedora-cosmic}"; shift || true
|
|
OWNER="${1:-Misthios}"; shift || true
|
|
DISTROS=("$@"); [[ ${#DISTROS[@]} -gt 0 ]] || DISTROS=(44 rawhide)
|
|
|
|
GITEA_URL="${GITEA_URL:-https://git.plabble.org}"
|
|
REGISTRY_HOST="${REGISTRY_HOST:-$(printf '%s' "${GITEA_URL}" | sed -E 's#https?://##')}"
|
|
TOKEN="${REGISTRY_TOKEN:?REGISTRY_TOKEN (write:package) is required}"
|
|
AUTHFILE="${AUTHFILE:-${HOME}/.docker/config.json}"
|
|
API="${GITEA_URL%/}/api/v1/packages/${OWNER}/container/${IMAGE}"
|
|
IMAGE_REF="${REGISTRY_HOST}/${OWNER}/${IMAGE}"
|
|
|
|
# Collect all versions (paginated).
|
|
versions=""
|
|
page=1
|
|
while :; do
|
|
page_json="$(curl -fsSL -H "Authorization: token ${TOKEN}" \
|
|
"${API}?limit=50&page=${page}")" || break
|
|
[[ "$(jq 'length' <<< "${page_json}")" -eq 0 ]] && break
|
|
versions+="$(jq -r '.[].version' <<< "${page_json}")"$'\n'
|
|
page=$((page + 1))
|
|
[[ "${page}" -gt 40 ]] && break
|
|
done
|
|
|
|
# Decide what to keep.
|
|
declare -A keep=()
|
|
for d in "${DISTROS[@]}"; do
|
|
keep["${d}"]=1
|
|
newest="$(grep -E "^${d}\.[0-9]+\.[0-9]+$" <<< "${versions}" \
|
|
| sort -t. -k2,2n -k3,3n | tail -1)"
|
|
[[ -n "${newest}" ]] && keep["${newest}"]=1
|
|
done
|
|
|
|
# Keep the cosign signature of each kept image tag.
|
|
for tag in "${!keep[@]}"; do
|
|
[[ "${tag}" == sha256-* ]] && continue
|
|
digest="$(skopeo inspect --authfile "${AUTHFILE}" --format '{{.Digest}}' \
|
|
"docker://${IMAGE_REF}:${tag}" 2>/dev/null || true)"
|
|
[[ -n "${digest}" ]] && keep["sha256-${digest#sha256:}.sig"]=1
|
|
done
|
|
|
|
# Delete everything else.
|
|
while IFS= read -r v; do
|
|
[[ -z "${v}" ]] && continue
|
|
if [[ -n "${keep[${v}]:-}" ]]; then
|
|
echo "keep ${v}"
|
|
else
|
|
echo "remove ${v}"
|
|
curl -fsSL -X DELETE -H "Authorization: token ${TOKEN}" \
|
|
"${API}/${v}" >/dev/null || echo " (failed to delete ${v})"
|
|
fi
|
|
done <<< "${versions}"
|
|
|
|
echo "Pruned ${IMAGE} registry versions."
|