ci: fix docker-ci.yml image cleanup after PR closure by Ryan-Millard · Pull Request #326 · Ryan-Millard/Img2Num

Ryan-Millard · 2026-04-22T22:41:05Z

What was changed & why

Cleanup job in docker-ci.yml was updated - lets hope it works.

Previously failed to delete the images,
see https://github.com/Ryan-Millard/Img2Num/actions/runs/24804191793/job/72594225429.

Fixes: #none - see here.

Changes

Simple job update

Testing & Verification

Additional Resources

Summary by CodeRabbit

Chores
- Updated the PR cleanup workflow to explicitly remove temporary container images created for pull requests (for both close and command triggers). This improves reliability of image cleanup, reduces leftover artifacts, and provides clearer logging when no matching images are found.

Previously failed to delete the images, see https://github.com/Ryan-Millard/Img2Num/actions/runs/24804191793/job/72594225429.

coderabbitai · 2026-04-22T22:41:13Z

Walkthrough

Replaces the previous actions/delete-package-versions cleanup with explicit gh api REST calls in the Docker CI workflow; computes PR number from the event, queries GHCR package versions by container tag metadata, and deletes matched versions by ID for pr-${PR} and cache-pr-${PR}.

Changes

Cohort / File(s)	Summary
GHCR Cleanup Workflow `.github/workflows/docker-ci.yml`	Replaces `actions/delete-package-versions` with `gh api` calls. Sets `GH_TOKEN` from `secrets.GHCR_DELETE_TOKEN`, derives PR number from event context, queries GHCR package versions for `img2num-dev` and deletes versions whose metadata container tags match `pr-${PR}` or `cache-pr-${PR}`. Prints message when no version found.

Sequence Diagram(s)

sequenceDiagram
participant Action as GitHub Action (runner)
participant GHAPI as GH REST API (api.github.com)
participant GHCR as GHCR package endpoint (api.github.com/orgs/.../packages/container/img2num-dev/versions)

Action->>GHAPI: Set GH_TOKEN (secrets.GHCR_DELETE_TOKEN)
Action->>Action: Determine PR number (event or needs.guard.outputs.pr_number)
loop for each tag in [pr-${PR}, cache-pr-${PR}]
    Action->>GHCR: GET versions (per_page=100)
    GHCR-->>Action: JSON list of versions (with metadata.container.tags)
    alt matching versions found
        Action->>GHAPI: DELETE /orgs/.../packages/container/.../versions/{id}
        GHAPI-->>Action: 204 No Content
    else no matches
        Action-->>Action: Log "No version found for tag"
    end
end

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

perf(Dockerfile.dev): improve build performance, architecture and code formatting #308: Edits to the same .github/workflows/docker-ci.yml cleanup workflow; likely touches the same logic paths.
refactor(docker-ci): default to main tag for CI and require maintainer sign-off on pushed builds #312: Introduced GHCR cleanup using actions/delete-package-versions that this change replaces.

Suggested labels

github_actions

Suggested reviewers

Krasner

Poem

🐰 I hop through YAML, tokens in paw,

calling GH APIs with a careful gnaw.
Tags searched and versions swept away,
A tidy registry to brighten my day. ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title follows Conventional Commit format with 'ci:' prefix and clearly describes the specific change: fixing Docker image cleanup after PR closure.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch fix/ci/docker-image-pr-cleanup

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/ci/docker-image-pr-cleanup

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Ryan-Millard · 2026-04-23T13:09:19Z

@coderabbitai full review

coderabbitai · 2026-04-23T13:09:29Z

✅ Actions performed

Full review triggered.

coderabbitai

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/docker-ci.yml (1)
9-10: ⚠️ Potential issue | 🟠 Major

Use pull_request_target for close cleanup that needs GHCR_DELETE_TOKEN.

Fork PRs triggered with pull_request do not receive repository secrets other than GITHUB_TOKEN, so cleanup fails after closing a fork PR because secrets.GHCR_DELETE_TOKEN (line 259) is unavailable. Since this job only performs API cleanup and does not checkout or execute PR code, switch to pull_request_target and update the job condition accordingly.
Proposed fix
 on:
@@
-  pull_request:
+  pull_request_target:
     types: [closed]
@@
   cleanup-on-close:
-    if: github.event_name == 'pull_request'
+    if: github.event_name == 'pull_request_target'
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.

In @.github/workflows/docker-ci.yml around lines 9 - 10, Change the workflow
trigger from pull_request to pull_request_target and update the job condition
that checks for GHCR_DELETE_TOKEN so cleanup jobs run on the target repo (not
fork) after a PR is closed; specifically, replace the trigger block containing
"pull_request: types: [closed]" with "pull_request_target: types: [closed]" and
ensure the job that references secrets.GHCR_DELETE_TOKEN (the cleanup job using
the GHCR_DELETE_TOKEN secret) is conditioned to run only when that secret is
present and the event is a closed PR on the target repo (no checkout or
execution of PR code).

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Outside diff comments:
In @.github/workflows/docker-ci.yml:
- Around line 9-10: Change the workflow trigger from pull_request to
pull_request_target and update the job condition that checks for
GHCR_DELETE_TOKEN so cleanup jobs run on the target repo (not fork) after a PR
is closed; specifically, replace the trigger block containing "pull_request:
types: [closed]" with "pull_request_target: types: [closed]" and ensure the job
that references secrets.GHCR_DELETE_TOKEN (the cleanup job using the
GHCR_DELETE_TOKEN secret) is conditioned to run only when that secret is present
and the event is a closed PR on the target repo (no checkout or execution of PR
code).

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: d7c5683f-4a2a-43ab-9f59-815a62b9d456

📥 Commits

Reviewing files that changed from the base of the PR and between 8ea6b19 and 2513908.

📒 Files selected for processing (1)

.github/workflows/docker-ci.yml

Ryan-Millard · 2026-05-02T16:27:28Z

@coderabbitai propose a conventional commit and description for this.

coderabbitai · 2026-05-02T16:27:48Z

Tip

For best results, initiate chat on the files or code changes.

@Ryan-Millard Here is a proposed conventional commit message and description:

Commit subject

fix(ci): replace actions/delete-package-versions with gh api calls for GHCR cleanup

Commit body

The `actions/delete-package-versions` action failed to delete Docker
images from GHCR after PR closure (see failed run referenced in PR
description). Replace it with explicit `gh api` REST calls in both
the `cleanup-on-close` and `cleanup-on-command` jobs.

For each PR, the workflow now:
- Derives the PR number from the triggering event.
- Iterates over the two target tags (`pr-<PR>` and `cache-pr-<PR>`)
  for the `img2num-dev` container package.
- Queries GHCR for all package versions, filters by matching container
  tag metadata, and deletes each matching version ID via a REST DELETE
  request authenticated with `GHCR_DELETE_TOKEN`.
- Prints a "No version found" notice when a tag has already been
  removed, avoiding false failures.

Commit footer

Ref: https://github.com/Ryan-Millard/Img2Num/actions/runs/24804191793/job/72594225429

So the full commit would look like:

fix(ci): replace actions/delete-package-versions with gh api calls for GHCR cleanup

The `actions/delete-package-versions` action failed to delete Docker
images from GHCR after PR closure (see failed run referenced in PR
description). Replace it with explicit `gh api` REST calls in both
the `cleanup-on-close` and `cleanup-on-command` jobs.

For each PR, the workflow now:
- Derives the PR number from the triggering event.
- Iterates over the two target tags (`pr-<PR>` and `cache-pr-<PR>`)
  for the `img2num-dev` container package.
- Queries GHCR for all package versions, filters by matching container
  tag metadata, and deletes each matching version ID via a REST DELETE
  request authenticated with `GHCR_DELETE_TOKEN`.
- Prints a "No version found" notice when a tag has already been
  removed, avoiding false failures.

Ref: https://github.com/Ryan-Millard/Img2Num/actions/runs/24804191793/job/72594225429

fix(docker-ci): fix docker image cleanup after PR closure

2513908

Previously failed to delete the images, see https://github.com/Ryan-Millard/Img2Num/actions/runs/24804191793/job/72594225429.

github-actions Bot added ci documentation labels Apr 22, 2026

coderabbitai Bot reviewed Apr 23, 2026

View reviewed changes

Ryan-Millard added 2 commits April 28, 2026 21:03

Merge branch 'main' into fix/ci/docker-image-pr-cleanup

3f67e35

Merge branch 'main' into fix/ci/docker-image-pr-cleanup

e32dc23

Ryan-Millard changed the title ~~fix(docker-ci): fix docker image cleanup after PR closure~~ ci: fix docker-ci.yml image cleanup after PR closure May 2, 2026

Merge branch 'main' into fix/ci/docker-image-pr-cleanup

baf2eed

Ryan-Millard merged commit 9c311c5 into main May 2, 2026
16 checks passed

Ryan-Millard deleted the fix/ci/docker-image-pr-cleanup branch May 2, 2026 16:34

coderabbitai Bot mentioned this pull request May 28, 2026

ci: add dev branch to docker-ci.yml and img2num scripts, pr-image cleanup fixes #398

Merged

Navigation Menu

Uh oh!

ci: fix docker-ci.yml image cleanup after PR closure - #326

ci: fix docker-ci.yml image cleanup after PR closure#326
Ryan-Millard merged 4 commits into
mainfrom
fix/ci/docker-image-pr-cleanup

Ryan-Millard commented Apr 22, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 22, 2026 •

edited

Loading

Uh oh!

Ryan-Millard commented Apr 23, 2026

Uh oh!

coderabbitai Bot commented Apr 23, 2026

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Ryan-Millard commented May 2, 2026

Uh oh!

coderabbitai Bot commented May 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

Ryan-Millard commented Apr 22, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What was changed & why

Changes

Testing & Verification

Additional Resources

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Sequence Diagram(s)

Estimated code review effort

Possibly related PRs

Suggested labels

Suggested reviewers

Poem

Uh oh!

Ryan-Millard commented Apr 23, 2026

Uh oh!

coderabbitai Bot commented Apr 23, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Ryan-Millard commented May 2, 2026

Uh oh!

coderabbitai Bot commented May 2, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Ryan-Millard commented Apr 22, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 22, 2026 •

edited

Loading