ci: implement ghcr.io expiration for images and cache layers

opendatahub-io / notebooks

Notebook images for ODH

Apache License 2.0

15 stars 51 forks source link

ci: implement ghcr.io expiration for images and cache layers #601

Closed jiridanek closed 1 week ago

jiridanek commented 1 week ago

Description

Fixes #568

How Has This Been Tested?

See the action in action at https://github.com/jiridanek/notebooks/actions/runs/9717613825/job/26823642202#step:3:18

The repos this is cleaning are https://github.com/jiridanek/notebooks/pkgs/container/notebooks%2Fworkbench-images and https://github.com/jiridanek/notebooks/pkgs/container/notebooks%2Fworkbench-images%2Fbuild-cache

Merge criteria:

[x] The commits are squashed in a cohesive manner and have meaningful messages.
[x] Testing instructions have been added in the PR body (for PRs involving changes that are not immediately obvious).
[x] The developer has manually tested the changes and verified that the changes work

atheo89 commented 1 week ago

Are we sure that sufficient time has been allocated to inspect the Trivy report before this workflow proceed to prune the images?

caponetto commented 1 week ago

Are we sure that sufficient time has been allocated to inspect the Trivy report before this workflow proceed to prune the images?

I don't see it as an issue since the workflow prunes images that are 3 weeks old. We can always resort to the latest report/image if necessary.

jiridanek commented 1 week ago

we could push :latest tags to ghcr and set the workflow to leave the newest image around, if we wanted to spend more time on this; before I did not want to have latest at all because hashes give so much more certainty all around

atheo89 commented 1 week ago

the workflow prunes images that are 3 weeks old

Ahhh ok i got it!

we could push :latest tags to ghcr and set the workflow to leave the newest image around, if we wanted to spend more time on this; before I did not want to have latest at all because hashes give so much more certainty all around

That's fine Jiri!

/lgtm /approve

openshift-ci[bot] commented 1 week ago

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: atheo89, caponetto, jstourac

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files: - ~~[OWNERS](https://github.com/opendatahub-io/notebooks/blob/main/OWNERS)~~ [atheo89] Approvers can indicate their approval by writing `/approve` in a comment Approvers can cancel approval by writing `/approve cancel` in a comment

jiridanek commented 1 week ago

/retest