Remove the manifest-list-unsafe image cleanup step - #23
Merged
Conversation
actions/delete-package-versions has no concept of a multi-arch manifest list's child manifests - each platform image and its attestation manifest are separate untagged "versions" to it, deleted by a simple keep-N-most-recent-untagged count. That can delete the very children a build just created and latest/the release tag now point to. Confirmed directly: it broke the v1.2.0 image within minutes of publishing it (min-versions-to-keep: 1 kept only one of four fresh untagged children). Removed the automatic cleanup step from publish-image.yaml's merge job, and retired cleanup-image-history.yaml entirely - its one-time job (clearing the pre-redesign sha/date tag backlog) is done, and re-running it is what broke things a second time. Releases are rare and deliberate now, so a few untagged versions accumulating between them isn't worth risking the published image over. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PeQipf4QUFGFaVceX8NcEP
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
actions/delete-package-versionshas no concept of a multi-arch manifest list's child manifests —each platform image and its attestation manifest are separate untagged "versions" to it, deleted
by a simple keep-N-most-recent-untagged count. That can delete the very children a build just
created and
latest/the release tag now point to.Confirmed directly while verifying the v1.2.0 release: the published image broke within minutes —
docker pull ghcr.io/talxis/tools-agentbox/image:1.2.0failed with a missing manifest, becausemin-versions-to-keep: 1inpublish-image.yaml's own routine cleanup step (and, worse, a manualre-run of the one-off
cleanup-image-history.yaml) deleted 3 of the 4 fresh untagged children(2 platform manifests + 2 attestation manifests) that build had just created.
publish-image.yaml'smergejob.cleanup-image-history.yamlentirely — its one-time job (clearing the pre-redesignsha/date tag backlog) is done, and re-running it is what broke things a second time.
Releases are rare and deliberate now (no more weekly-cron-driven sprawl), so a few untagged
versions accumulating between them isn't worth risking the published image over. If cleanup is
ever wanted again, it needs a manifest-list-aware tool (e.g.
dataaxiom/ghcr-cleanup-action), notthis one.
Test plan
publish-image.yaml's v1.2.0 run and confirmdocker pull ghcr.io/talxis/tools-agentbox/image:1.2.0succeeds and stays working afterward (no cleanupstep left to break it).
Generated by Claude Code