Add cleanup container registry jobs

.github/workflows/build-and-push.yml

@@ -10,7 +10,7 @@ on:
 
 jobs:
   build-and-push-image:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
 
     permissions:
       contents: read
@@ -52,7 +52,7 @@ jobs:
           push-to-registry: true
 
   test-image:
-    runs-on: ubuntu-24.04
+    runs-on: ubuntu-latest
     needs: build-and-push-image
     if: startsWith(github.ref, 'refs/tags/')
     strategy:
@@ -80,3 +80,35 @@ jobs:
         run: |
           docker pull ghcr.io/onegov/onegov-cloud:${{ steps.meta.outputs.version }}
           docker run ghcr.io/onegov/onegov-cloud:${{ steps.meta.outputs.version }} test-container "${{matrix.group}}" 6
+
+  cleanup-images:
+    runs-on: ubuntu-latest
+    needs: build-and-push-image
+
+    steps:
+
+      - name: Delete unttaged images
+        uses: seantis/delete-package-versions@main
+        with:
+          package-name: 'onegov-cloud'
+          package-type: 'container'
+          min-versions-to-keep: 0
+          delete-only-untagged-versions: 'true'
+
+      - name: Delete images tagged with commit hash
+        uses: seantis/delete-package-versions@main
+        with:
+          package-name: 'onegov-cloud'
+          package-type: 'container'
+          min-versions-to-keep: 0
+          ignore-versions: '^(?!sha).*$'
+          ignore-versions-include-tags: true
+
+      - name: Delete old images
+        uses: seantis/delete-package-versions@main
+        with:
+          package-name: 'onegov-cloud'
+          package-type: 'container'
+          min-versions-to-keep: 20
+          ignore-versions: '^release-.*$'
+          ignore-versions-include-tags: true