cleanup-packages.yml

name: Cleanup old package versions

# Each release keeps its exact version tag (1.2.3) after `latest`/`1.2`/`1` move on, so nothing goes
# untagged routinely any more; what's left to prune is the pre-1.0.0 `:latest`-era backlog and any
# orphans. Keep the newest 10 tagged versions (a release's four tags share one version, so that's the
# last 10 releases), delete everything untagged, never touch `latest`. The old 30-day window is gone:
# it only existed to guess how long a consumer might still pin an unprotected digest, and consumers
# now pin a retained tag (APPENDIX.md#versioning-releases).
#
# Back in dry-run because the rules changed and the first run clears the whole historical backlog:
# review one run's output, then flip dry-run to false. Deleting published versions is outward-facing.

on:
  schedule:
    - cron: "30 4 * * 1"   # Mondays 04:30 UTC, matching Renovate's weekly cadence
  workflow_dispatch:

# One cleanup at a time; don't cancel an in-flight run.
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false

permissions:
  contents: read
  packages: write

jobs:
  cleanup:
    runs-on: ubuntu-latest
    steps:
      - name: Prune untagged, keep the newest 10 tagged releases
        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1
        with:
          packages: linterpol,linterpol-jvm,linterpol-dotnet
          keep-n-tagged: 10
          delete-untagged: true
          exclude-tags: latest
          validate: true   # every retained multi-arch index still has its per-arch children
          dry-run: true