Cleanup #278
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # SPDX-License-Identifier: Apache-2.0 | |
| name: Cleanup | |
| on: | |
| schedule: | |
| - cron: "0 0 * * *" # Daily at midnight | |
| permissions: | |
| contents: read | |
| defaults: | |
| run: | |
| shell: bash | |
| env: | |
| LC_ALL: C.UTF-8 | |
| jobs: | |
| images: | |
| runs-on: hiero-mirror-node-linux-medium | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| module: | |
| [ | |
| graphql, | |
| grpc, | |
| importer, | |
| monitor, | |
| rest, | |
| rest-java, | |
| rest-monitor, | |
| rosetta, | |
| test, | |
| web3, | |
| ] | |
| permissions: | |
| contents: "read" | |
| id-token: "write" | |
| steps: | |
| - name: Harden Runner | |
| uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2 | |
| with: | |
| egress-policy: audit | |
| # Instead of checking out the code which is completely unnecessary, create the workspace folder, | |
| # and .git/info/exclude, required by google-github-auth | |
| - name: Create Workspace | |
| run: mkdir -p "${{ github.workspace }}/.git/info" && touch "${{ github.workspace }}/.git/info/exclude" | |
| - name: Authenticate to Google Cloud | |
| uses: step-security/google-github-auth@57c51210cb4d85d8a5d39dc4c576c79bd693f914 # v3.0.1 | |
| with: | |
| service_account: "mirrornode-gh-actions-sa@mirrornode.iam.gserviceaccount.com" | |
| workload_identity_provider: "projects/521285740332/locations/global/workloadIdentityPools/mirrornode-gh-actions/providers/mirrornode-gh-actions" | |
| - name: Setup gcloud | |
| uses: google-github-actions/setup-gcloud@aa5489c8933f4cc7a4f7d45035b3b1440c9c10db # v3.0.1 | |
| with: | |
| cache: true | |
| - name: Configure Docker | |
| run: gcloud auth configure-docker gcr.io,marketplace.gcr.io | |
| - name: Delete old untagged images | |
| run: | | |
| set -ex | |
| DELETE_BEFORE_MS="$(date -d "-7 days" '+%s')000" | |
| IMAGE_REPO=mirrornode/hedera-mirror-${{ matrix.module }} | |
| IMAGE_PATH="gcr.io/$IMAGE_REPO" | |
| BASE_REGISTRY_API_URL="https://gcr.io/v2/$IMAGE_REPO" | |
| IMAGES_JSON_FILE="/tmp/images.json" | |
| curl "$BASE_REGISTRY_API_URL/tags/list" | \ | |
| # select manifests older than DELETE_BEFORE_MS, then select manifests with tag matching "main-.+" | |
| jq --arg delete_before_ms "$DELETE_BEFORE_MS" '.manifest | to_entries | | |
| map(select(.value.timeUploadedMs < $delete_before_ms)) | | |
| map(select(.value.tag | map(test("main-.+")) | any))' | \ | |
| tee "$IMAGES_JSON_FILE" | |
| ALL_DIGESTS=($(cat "$IMAGES_JSON_FILE" | jq -r '[.[].key] | join(" ")')) | |
| CHILD_DIGESTS=() | |
| MULTI_PLATFORM_DIGESTS=($(cat "$IMAGES_JSON_FILE" | \ | |
| jq -r 'map(select(.value.mediaType == "application/vnd.docker.distribution.manifest.list.v2+json")) | | |
| [.[].key] | join(" ")')) | |
| for digest in ${MULTI_PLATFORM_DIGESTS[*]}; do | |
| # add child image digests to ALL_DIGESTS | |
| CHILD_DIGESTS+=($(curl "$BASE_REGISTRY_API_URL/manifests/$digest" | \ | |
| jq -r '[.manifests[].digest] | join(" ")')) | |
| done | |
| # dedup the child digests since some may be shared by list type images | |
| CHILD_DIGESTS=($(printf '%s\n' "${CHILD_DIGESTS[@]}" | sort -u)) | |
| ALL_DIGESTS+=(${CHILD_DIGESTS[@]}) | |
| for digest in ${ALL_DIGESTS[@]}; do | |
| gcloud container images delete --force-delete-tags -q "${IMAGE_PATH}@${digest}" | |
| done |