jcoffey-dev
f95f10809a
The fork had CI and nothing after it. v2026.9.20 was tagged and released by hand, and there has never been an image: running INBUXA meant building the tree yourself, or using install.sh to do it for you. This adds the three workflows ihasmail already runs -- weekly release, publish, prune. Monday 10:07 UTC, and nothing on a quiet week. Last of the three, so INBUXA Admin and the webmail release ahead of the server they talk to, and staggered so a bad Monday names one repository rather than three. The version is the difference from ihasmail. ihasmail derives its version from the commit it builds, so its release only reads. INBUXA's lives in the brand_version! macro, deliberately apart from Cargo.toml so upstream's bumps merge without conflicts -- so the release writes it: the bump is committed to main and the tag names that commit. The tree a tag points at therefore reports the version the tag claims, which a tag placed beside an unbumped macro cannot promise. Both the bump and the read are scoped to the macro body and fail if they do not match exactly once. branding.rs holds other string literals, and a bump that silently edited one of those, or an image tagged from one, would be worse than a run that stops. The existing Dockerfile needs nothing: it cross-compiles from BUILDPLATFORM and takes no arguments beyond TARGETPLATFORM, so each architecture builds on its own native runner as ihasmail's does, without docker-bake.hcl. `docker build --check` is clean. Two things to expect from the first run. GHCR creates a package private the first time even in a public repository, and no workflow can change that, so the first image will refuse an anonymous pull until its visibility is set by hand. And a full Rust build of this tree is long; the per-platform GitHub Actions cache is what keeps the second one from being just as long, and it is worth watching that it stays inside the cache limit.
70 lines
3.1 KiB
YAML
70 lines
3.1 KiB
YAML
# Prune old image versions from GHCR.
|
|
#
|
|
# Releases are kept forever -- they carry no assets and their generated notes
|
|
# are this project's only changelog, so deleting one destroys history that
|
|
# cannot be reconstructed for nothing saved. Images are the opposite: a
|
|
# multi-arch build a week, and the by-digest push in publish.yml leaves two
|
|
# untagged per-architecture manifests behind each time on top of the tagged
|
|
# index. Those accumulate and nobody wants fifty of them.
|
|
#
|
|
# THE FOOTGUN: the obvious tool for this -- delete-package-versions with
|
|
# `delete-only-untagged-versions` -- will happily delete the per-architecture
|
|
# manifests that a multi-arch tag points *at*, because they are untagged by
|
|
# design. Nothing appears to break: the tag still exists, and pulls simply
|
|
# start failing for one architecture. This action understands manifest lists
|
|
# and will not orphan a retained index, and `validate` re-checks every
|
|
# multi-arch manifest against the registry afterwards.
|
|
#
|
|
# Separate from publish.yml, and dispatchable on its own, so `dry_run` can show
|
|
# exactly what would be deleted without rebuilding and re-pushing an image to
|
|
# find out.
|
|
name: Prune images
|
|
|
|
on:
|
|
workflow_call:
|
|
inputs:
|
|
dry_run:
|
|
type: boolean
|
|
default: false
|
|
workflow_dispatch:
|
|
inputs:
|
|
dry_run:
|
|
description: "List what would be deleted, delete nothing"
|
|
type: boolean
|
|
default: true
|
|
|
|
jobs:
|
|
prune:
|
|
runs-on: ubuntu-latest
|
|
permissions:
|
|
packages: write
|
|
steps:
|
|
# The only third-party action here that is not published by GitHub or
|
|
# Docker, and the one with the most to lose: it is handed
|
|
# `packages: write` and its whole job is deletion, so a ref repointed at
|
|
# something else -- by a compromise or a mistake upstream -- is a bad
|
|
# day. It was pinned to a commit long before the rest of them were.
|
|
- uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
|
|
with:
|
|
owner: inbuxa
|
|
package: inbuxa-server
|
|
token: ${{ secrets.GITHUB_TOKEN }}
|
|
# Ten weekly releases is roughly a quarter of history, which is more
|
|
# than enough to roll back to and far less than the year's worth that
|
|
# would otherwise pile up. Older *releases* stay either way; this
|
|
# only removes the images.
|
|
keep-n-tagged: 10
|
|
# Belt and braces on top of the action's own manifest awareness:
|
|
# `latest` is never a candidate for deletion under any counting.
|
|
exclude-tags: latest
|
|
delete-untagged: true
|
|
# Sweeps the wreckage of a half-failed run: an index whose platform
|
|
# images did not all land, and referrers whose parent is gone.
|
|
delete-partial-images: true
|
|
delete-orphaned-images: true
|
|
# Checks every remaining multi-architecture manifest still resolves
|
|
# in the registry. This is the step that would catch the footgun
|
|
# above rather than leaving a reader to discover it on `docker pull`.
|
|
validate: true
|
|
dry-run: ${{ inputs.dry_run }}
|