From ebb654745793d393a81fda613c0c2a34373b01db Mon Sep 17 00:00:00 2001
From: Louis King <jinglemansweep@gmail.com>
Date: Mon, 15 Jun 2026 15:00:34 +0100
Subject: [PATCH] ci: prune old untagged GHCR package versions

Add actions/delete-package-versions@v5 to both Docker build pipelines to
clean up orphaned untagged manifests left behind by multi-arch rebuilds.

Uses delete-only-untagged-versions so tagged versions (v*, latest, main,
sha-*) are never deleted, with min-versions-to-keep: 10 to protect the
freshly-pushed image's own untagged child/attestation manifests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/docker-mqtt-broker.yml | 10 ++++++++++
 .github/workflows/docker.yml             | 10 ++++++++++
 2 files changed, 20 insertions(+)

diff --git a/.github/workflows/docker-mqtt-broker.yml b/.github/workflows/docker-mqtt-broker.yml
index 4b01bf1..967efe0 100644
--- a/.github/workflows/docker-mqtt-broker.yml
+++ b/.github/workflows/docker-mqtt-broker.yml
@@ -117,6 +117,16 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Delete old untagged package versions
+        if: steps.decide.outputs.changed == 'true'
+        continue-on-error: true
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: meshcore-mqtt-broker
+          package-type: container
+          delete-only-untagged-versions: "true"
+          min-versions-to-keep: 10
+
       - name: Skip build (unchanged)
         if: steps.decide.outputs.changed != 'true'
         run: echo "Upstream ${{ steps.check.outputs.upstream_sha }} already built; skipping."
diff --git a/.github/workflows/docker.yml b/.github/workflows/docker.yml
index 3c6fcf0..32d4222 100644
--- a/.github/workflows/docker.yml
+++ b/.github/workflows/docker.yml
@@ -69,6 +69,16 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
+      - name: Delete old untagged package versions
+        if: github.event_name != 'pull_request'
+        continue-on-error: true
+        uses: actions/delete-package-versions@v5
+        with:
+          package-name: ${{ github.event.repository.name }}
+          package-type: container
+          delete-only-untagged-versions: "true"
+          min-versions-to-keep: 10
+
       - name: Test Docker image
         if: github.event_name == 'pull_request'
         run: |