Docker cleanup (branch deletion) #6049
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Docker cleanup (branch deletion) | |
| on: | |
| delete: | |
| permissions: | |
| contents: read | |
| jobs: | |
| cleanup: | |
| # Only run for branch deletions (not tag deletions) in the fleetdm/fleet repo. | |
| if: ${{ github.event.ref_type == 'branch' && github.repository == 'fleetdm/fleet' }} | |
| runs-on: ubuntu-latest | |
| environment: Docker Hub | |
| steps: | |
| - name: Sanitize branch name | |
| id: sanitize | |
| env: | |
| BRANCH: ${{ github.event.ref }} | |
| run: | | |
| SANITIZED="${BRANCH//\//-}" | |
| echo "TAG=$SANITIZED" >> $GITHUB_OUTPUT | |
| - name: Skip protected branches | |
| id: check_protected | |
| env: | |
| TAG: ${{ steps.sanitize.outputs.TAG }} | |
| run: | | |
| if [[ "$TAG" == "main" || "$TAG" == rc-minor-* || "$TAG" == rc-patch-* ]]; then | |
| echo "skip=true" >> $GITHUB_OUTPUT | |
| echo "Skipping cleanup for protected branch tag: $TAG" | |
| else | |
| echo "skip=false" >> $GITHUB_OUTPUT | |
| fi | |
| - name: Delete tag from Docker Hub | |
| if: steps.check_protected.outputs.skip == 'false' | |
| env: | |
| TAG: ${{ steps.sanitize.outputs.TAG }} | |
| DOCKERHUB_USERNAME: ${{ secrets.DOCKERHUB_USERNAME }} | |
| DOCKERHUB_ACCESS_TOKEN: ${{ secrets.DOCKERHUB_ACCESS_TOKEN }} | |
| run: | | |
| # Authenticate and get JWT | |
| TOKEN=$(curl -s -X POST "https://hub.docker.com/v2/users/login/" \ | |
| -H "Content-Type: application/json" \ | |
| -d "{\"username\": \"$DOCKERHUB_USERNAME\", \"password\": \"$DOCKERHUB_ACCESS_TOKEN\"}" \ | |
| | jq -r .token) | |
| # Bail if the token is empty (authentication failed) | |
| if [[ -z "$TOKEN" ]]; then | |
| echo "Failed to authenticate with Docker Hub. Check credentials." | |
| exit 1 | |
| fi | |
| # Delete the tag (ignore 404 — tag may not exist) | |
| HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \ | |
| "https://hub.docker.com/v2/repositories/fleetdm/fleet/tags/${TAG}/" \ | |
| -H "Authorization: Bearer $TOKEN") | |
| if [[ "$HTTP_STATUS" == "204" ]]; then | |
| echo "Deleted Docker Hub tag: $TAG" | |
| elif [[ "$HTTP_STATUS" == "404" ]]; then | |
| echo "Docker Hub tag not found (already deleted or never published): $TAG" | |
| else | |
| echo "Unexpected response from Docker Hub: HTTP $HTTP_STATUS" | |
| exit 1 | |
| fi | |
| - name: Delete tag from Quay.io | |
| if: steps.check_protected.outputs.skip == 'false' | |
| env: | |
| TAG: ${{ steps.sanitize.outputs.TAG }} | |
| QUAY_REGISTRY_PASSWORD: ${{ secrets.QUAY_REGISTRY_PASSWORD }} | |
| run: | | |
| # The robot account used for `docker push` can only authenticate against the | |
| # registry API (not Quay's REST API), so delete the tag via the v2 manifest endpoint. | |
| TOKEN=$(curl -s -u "fleetdm+fleetreleaser:$QUAY_REGISTRY_PASSWORD" \ | |
| "https://quay.io/v2/auth?service=quay.io&scope=repository:fleetdm/fleet:pull,push" \ | |
| | jq -r .token) | |
| if [[ -z "$TOKEN" || "$TOKEN" == "null" ]]; then | |
| echo "Failed to authenticate with Quay.io. Check credentials." | |
| exit 1 | |
| fi | |
| HTTP_STATUS=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \ | |
| "https://quay.io/v2/fleetdm/fleet/manifests/${TAG}" \ | |
| -H "Authorization: Bearer $TOKEN") | |
| if [[ "$HTTP_STATUS" == "202" || "$HTTP_STATUS" == "200" || "$HTTP_STATUS" == "204" ]]; then | |
| echo "Deleted Quay.io tag: $TAG" | |
| elif [[ "$HTTP_STATUS" == "404" ]]; then | |
| echo "Quay.io tag not found (already deleted or never published): $TAG" | |
| else | |
| echo "Unexpected response from Quay.io: HTTP $HTTP_STATUS" | |
| exit 1 | |
| fi |