99 lines
4.4 KiB
TypeScript
99 lines
4.4 KiB
TypeScript
// Prunes the app's container package in the Gitea registry: a commit-hash tag survives only
|
|
// while its commit is a branch head or carries a vX.Y.Z release tag. Untagged sha256:* package
|
|
// versions are CHILD manifests (arch image + provenance) of the tagged OCI indexes — deleting
|
|
// one that a surviving tag still references breaks that image, so only the ones no kept tag
|
|
// references are removed. Named tags (1.2.3, latest, …) are never touched.
|
|
import { planHashTagDeletions, selectOrphanedManifests } from "./select-versions.ts";
|
|
|
|
function env(name: string): string {
|
|
const value = process.env[name];
|
|
if (value === undefined || value === "") throw new Error(`Missing env var ${name}`);
|
|
return value;
|
|
}
|
|
|
|
const registryToken = env("REGISTRY_TOKEN");
|
|
const registryUser = env("REGISTRY_USER");
|
|
const repoToken = env("REPO_TOKEN");
|
|
const repository = env("REPOSITORY");
|
|
const serverUrl = env("SERVER_URL").replace(/\/+$/, "");
|
|
|
|
const [owner, name] = repository.split("/");
|
|
if (owner === undefined || name === undefined || owner === "" || name === "") {
|
|
throw new Error(`REPOSITORY must be owner/name, got "${repository}"`);
|
|
}
|
|
|
|
async function fetchOk(url: string, init: RequestInit): Promise<Response> {
|
|
const res = await fetch(url, init);
|
|
if (!res.ok) throw new Error(`${init.method ?? "GET"} ${url} -> ${res.status}: ${await res.text()}`);
|
|
return res;
|
|
}
|
|
|
|
async function apiGetAllPages<T>(path: string, token: string): Promise<T[]> {
|
|
const all: T[] = [];
|
|
const limit = 50;
|
|
for (let page = 1; ; page++) {
|
|
const sep = path.includes("?") ? "&" : "?";
|
|
const res = await fetchOk(`${serverUrl}/api/v1${path}${sep}limit=${limit}&page=${page}`, {
|
|
headers: { authorization: `token ${token}` },
|
|
});
|
|
const batch = (await res.json()) as T[];
|
|
// Stop on an empty page, not a short one — a lowered server page-size cap would otherwise
|
|
// silently truncate the list, and a truncated branch/tag list deletes protected images.
|
|
if (batch.length === 0) return all;
|
|
all.push(...batch);
|
|
}
|
|
}
|
|
|
|
async function childDigests(tag: string): Promise<string[]> {
|
|
const res = await fetchOk(`${serverUrl}/v2/${owner}/${name}/manifests/${tag}`, {
|
|
headers: {
|
|
accept: [
|
|
"application/vnd.oci.image.index.v1+json",
|
|
"application/vnd.docker.distribution.manifest.list.v2+json",
|
|
"application/vnd.oci.image.manifest.v1+json",
|
|
"application/vnd.docker.distribution.manifest.v2+json",
|
|
].join(", "),
|
|
authorization: `Basic ${Buffer.from(`${registryUser}:${registryToken}`).toString("base64")}`,
|
|
},
|
|
});
|
|
const manifest = (await res.json()) as { manifests?: { digest: string }[] };
|
|
return (manifest.manifests ?? []).map((m) => m.digest);
|
|
}
|
|
|
|
async function deleteVersion(version: string): Promise<void> {
|
|
const url = `${serverUrl}/api/v1/packages/${owner}/container/${name}/${encodeURIComponent(version)}`;
|
|
const res = await fetch(url, { headers: { authorization: `token ${registryToken}` }, method: "DELETE" });
|
|
if (res.status === 404) {
|
|
console.log(`already gone: ${version}`);
|
|
return;
|
|
}
|
|
if (!res.ok) throw new Error(`DELETE ${url} -> ${res.status}: ${await res.text()}`);
|
|
console.log(`deleted: ${version}`);
|
|
}
|
|
|
|
const branches = await apiGetAllPages<{ commit: { id: string } }>(`/repos/${owner}/${name}/branches`, repoToken);
|
|
if (branches.length === 0) throw new Error("no branches returned — refusing to prune with an empty keep-set");
|
|
const tags = await apiGetAllPages<{ commit: { sha: string }; name: string }>(`/repos/${owner}/${name}/tags`, repoToken);
|
|
const packages = await apiGetAllPages<{ name: string; version: string }>(
|
|
`/packages/${owner}?type=container&q=${encodeURIComponent(name)}`,
|
|
registryToken,
|
|
);
|
|
|
|
const versions = packages.filter((p) => p.name === name).map((p) => p.version);
|
|
const plan = planHashTagDeletions({
|
|
branchHeadShas: branches.map((b) => b.commit.id),
|
|
releaseTagShas: tags.filter((t) => /^v\d+\.\d+\.\d+$/.test(t.name)).map((t) => t.commit.sha),
|
|
versions,
|
|
});
|
|
|
|
const referenced = new Set<string>();
|
|
for (const tag of plan.keptTags) {
|
|
for (const digest of await childDigests(tag)) referenced.add(digest);
|
|
}
|
|
const orphans = selectOrphanedManifests({ referencedDigests: [...referenced], versions });
|
|
|
|
for (const version of [...plan.deletions, ...orphans]) await deleteVersion(version);
|
|
console.log(
|
|
`kept ${plan.keptTags.length} tags; deleted ${plan.deletions.length} hash tags and ${orphans.length} orphaned manifests`,
|
|
);
|