Gate PR Docker image publishing behind push-image label; add GHCR cleanup - #18
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
There was a problem hiding this comment.
Pull request overview
Updates project documentation around Docker image publishing for pull requests and the cleanup policy for ephemeral GHCR artifacts.
Changes:
- Document a new PR image publishing gate via a
push-imagelabel. - Document weekly cleanup of ephemeral
pr-*tags and untagged manifests.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| Pull requests build and test images but do not publish them unless a maintainer adds the | ||
| `push-image` label, which publishes ephemeral `pr-NN` / `pr-NN-dev` tags (same-repo PRs | ||
| only). Ephemeral `pr-*` tags and untagged manifests are cleaned up weekly; version tags | ||
| are kept forever, so pinned deployments are never affected. |
There was a problem hiding this comment.
Correct observation, but intentional: the matching workflow changes cannot be pushed from this automation session (its credentials lack the workflow scope for .github/workflows/ files). They were delivered to the maintainer as a git am-ready patch — see the note in the PR description. This PR should merge only once that patch commit lands on the branch, at which point the README and workflows agree.
Generated by Claude Code
- PR runs now build and test images without publishing. Adding the 'push-image' label to a same-repo PR publishes the pr-NN / pr-NN-dev tags (the 'labeled' event re-triggers the workflow). Fork PRs never push - their GITHUB_TOKEN cannot write packages, which previously would have failed the job outright. - Set retention-days: 1 on the dev-image tar artifacts, which are only consumed by the next job in the same run. - Add a weekly ghcr-cleanup workflow that deletes ephemeral pr-* tags and untagged manifests older than a week, complementing the post-push cleanup-untagged job (which never runs on PR events). Version and branch tags are never touched, so pinned deployments are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
Uh oh!
There was an error while loading. Please reload this page.
Summary
Changes the Docker publishing policy per discussion: PRs build and test images but no longer publish them by default.
push-imagelabel gate: on pull requests, thePush Dev Imagesjob and theproimage push only run when a maintainer adds thepush-imagelabel to a same-repo PR (thelabeledevent type re-triggers the workflow, so adding the label publishes without needing a new push). Fork PRs never push — theirGITHUB_TOKENcan't write packages, which previously would have failed the job outright on the first community PR touchingmagg/**.ghcr-cleanup.yml): deletes ephemeralpr-*tags and untagged manifests older than a week, usingdataaxiom/ghcr-cleanup-action(multi-arch-safe, with post-run validation). This complements the existingcleanup-untaggedjob, which runs after branch pushes but never on PR events. Version tags (1.2.3,1.2,*-dev-py3.x) and moving branch tags (dev,beta) are never touched, so pinned production deployments are unaffected. Manual dispatch supports a dry-run mode (default on).Setup after merge: create the
push-imagelabel (any color) in the repo's label settings.🤖 Generated with Claude Code
https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
Generated by Claude Code