@catladder/pipeline 1.115.0 → 1.117.0

package/examples/__snapshots__/node-build-with-custom-image.ts.snap

@@ -245,21 +245,28 @@ COPY --chown=node:node .yarn /app/.yarn",
           },
         ],
         "script": [
+          "echo -e "\\e[0Ksection_start:$(date +%s):prepare[collapsed=true]\\r\\e[0KPrepare..."",
           "echo $CL_dev_www_GCLOUD_DEPLOY_credentialsKey > ./____keyfile.json
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe asdf --format="value(projectNumber)")",
           "echo "GCLOUD_PROJECT_NUMBER: $GCLOUD_PROJECT_NUMBER"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0Kpushing image to artifacts registry"",
+          "echo -e "\\e[0Ksection_end:$(date +%s):prepare\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0KPushing image to artifacts registry"",
           "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
           "gcloud auth configure-docker asia-east1-docker.pkg.dev",
           "docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
           "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www:$DOCKER_IMAGE_TAG",
           "docker push asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www:$DOCKER_IMAGE_TAG",
           "echo -e "\\e[0Ksection_end:$(date +%s):pushToArtifactRegistry\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):deploy[collapsed=true]\\r\\e[0KDeploy to cloud run"",
           "echo "$ENV_VARS" > ____envvars.yaml",
           "gcloud run deploy pan-test-app-dev-www --command="yarn,start" --image=asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www:$DOCKER_IMAGE_TAG --project=asdf --region=asia-east1 --labels=customer-name=pan,component-name=www,app-name=test-app,env-type=dev,env-name=dev,build-type=node --env-vars-file=____envvars.yaml --min-instances=0 --max-instances=100 --cpu-throttling --allow-unauthenticated --cpu-boost",
-          "docker image rm asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www:$DOCKER_IMAGE_TAG",
+          "echo -e "\\e[0Ksection_end:$(date +%s):deploy\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):cleanup[collapsed=true]\\r\\e[0KCleanup"",
+          "gcloud run revisions list --project=asdf --region=asia-east1 --service=pan-test-app-dev-www --limit=unlimited --sort-by=metadata.creationTimestamp --format="value(name)" --filter='(status.conditions.status=False OR status.conditions.status=Unknown)' | while read -r revisionname; do gcloud run revisions delete --project=asdf --region=asia-east1 --quiet $revisionname ; done",
+          "gcloud artifacts docker images list asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www --sort-by=~CREATE_TIME --format="value(version)" | tail -n +2 | while read -r version; do gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www@$version --quiet --delete-tags; done",
+          "echo -e "\\e[0Ksection_end:$(date +%s):cleanup\\r\\e[0K"",
           "echo Uploading SBOM to Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/www" "https://pan-test-app-dev-www-unknown-host.example.com" "__sbom.json" vex.json || true",
         ],
@@ -347,6 +354,7 @@ _ALL_ENV_VAR_KEYS: '["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_ID","BUILD_INF
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "gcloud run services delete pan-test-app-dev-www --project=asdf --region=asia-east1",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/dev/www --quiet --delete-tags",
           "echo Disabling component in Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/www" "https://pan-test-app-dev-www-unknown-host.example.com" || true",
           "set -e",
@@ -764,21 +772,31 @@ COPY --chown=node:node .yarn /app/.yarn",
           },
         ],
         "script": [
+          "echo -e "\\e[0Ksection_start:$(date +%s):prepare[collapsed=true]\\r\\e[0KPrepare..."",
           "echo $CL_review_www_GCLOUD_DEPLOY_credentialsKey > ./____keyfile.json
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe asdf --format="value(projectNumber)")",
           "echo "GCLOUD_PROJECT_NUMBER: $GCLOUD_PROJECT_NUMBER"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0Kpushing image to artifacts registry"",
+          "echo -e "\\e[0Ksection_end:$(date +%s):prepare\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0KPushing image to artifacts registry"",
           "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
           "gcloud auth configure-docker asia-east1-docker.pkg.dev",
           "docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
           "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234:$DOCKER_IMAGE_TAG",
           "docker push asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234:$DOCKER_IMAGE_TAG",
           "echo -e "\\e[0Ksection_end:$(date +%s):pushToArtifactRegistry\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):deploy[collapsed=true]\\r\\e[0KDeploy to cloud run"",
           "echo "$ENV_VARS" > ____envvars.yaml",
           "gcloud run deploy pan-test-app-review-mr1234-www --command="yarn,start" --image=asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234:$DOCKER_IMAGE_TAG --project=asdf --region=asia-east1 --labels=customer-name=pan,component-name=www,app-name=test-app,env-type=review,env-name=review,build-type=node --env-vars-file=____envvars.yaml --min-instances=0 --max-instances=100 --cpu-throttling --allow-unauthenticated --cpu-boost",
-          "docker image rm asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234:$DOCKER_IMAGE_TAG",
+          "echo -e "\\e[0Ksection_end:$(date +%s):deploy\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):cleanup[collapsed=true]\\r\\e[0KCleanup"",
+          "gcloud run revisions list --project=asdf --region=asia-east1 --service=pan-test-app-review-mr1234-www --limit=unlimited --sort-by=metadata.creationTimestamp --format="value(name)" --filter='(status.conditions.status=False OR status.conditions.status=Unknown)' | while read -r revisionname; do gcloud run revisions delete --project=asdf --region=asia-east1 --quiet $revisionname ; done",
+          "gcloud artifacts docker images list asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234 --sort-by=~CREATE_TIME --format="value(version)" | tail -n +2 | while read -r version; do gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234@$version --quiet --delete-tags; done",
+          "set +e",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www --quiet --delete-tags",
+          "set -e",
+          "echo -e "\\e[0Ksection_end:$(date +%s):cleanup\\r\\e[0K"",
           "echo Uploading SBOM to Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/www" "https://pan-test-app-review-mr1234-www-unknown-host.example.com" "__sbom.json" vex.json || true",
         ],
@@ -866,6 +884,10 @@ _ALL_ENV_VAR_KEYS: '["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_ID","BUILD_INF
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "gcloud run services delete pan-test-app-review-mr1234-www --project=asdf --region=asia-east1",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www/mr1234 --quiet --delete-tags",
+          "set +e",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/review/www --quiet --delete-tags",
+          "set -e",
           "echo Disabling component in Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/www" "https://pan-test-app-review-mr1234-www-unknown-host.example.com" || true",
           "set -e",
@@ -1371,21 +1393,28 @@ COPY --chown=node:node .yarn /app/.yarn",
           },
         ],
         "script": [
+          "echo -e "\\e[0Ksection_start:$(date +%s):prepare[collapsed=true]\\r\\e[0KPrepare..."",
           "echo $CL_prod_www_GCLOUD_DEPLOY_credentialsKey > ./____keyfile.json
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe asdf --format="value(projectNumber)")",
           "echo "GCLOUD_PROJECT_NUMBER: $GCLOUD_PROJECT_NUMBER"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0Kpushing image to artifacts registry"",
+          "echo -e "\\e[0Ksection_end:$(date +%s):prepare\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0KPushing image to artifacts registry"",
           "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
           "gcloud auth configure-docker asia-east1-docker.pkg.dev",
           "docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
           "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www:$DOCKER_IMAGE_TAG",
           "docker push asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www:$DOCKER_IMAGE_TAG",
           "echo -e "\\e[0Ksection_end:$(date +%s):pushToArtifactRegistry\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):deploy[collapsed=true]\\r\\e[0KDeploy to cloud run"",
           "echo "$ENV_VARS" > ____envvars.yaml",
           "gcloud run deploy pan-test-app-prod-www --command="yarn,start" --image=asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www:$DOCKER_IMAGE_TAG --project=asdf --region=asia-east1 --labels=customer-name=pan,component-name=www,app-name=test-app,env-type=prod,env-name=prod,build-type=node --env-vars-file=____envvars.yaml --min-instances=0 --max-instances=100 --cpu-throttling --allow-unauthenticated --cpu-boost",
-          "docker image rm asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www:$DOCKER_IMAGE_TAG",
+          "echo -e "\\e[0Ksection_end:$(date +%s):deploy\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):cleanup[collapsed=true]\\r\\e[0KCleanup"",
+          "gcloud run revisions list --project=asdf --region=asia-east1 --service=pan-test-app-prod-www --limit=unlimited --sort-by=metadata.creationTimestamp --format="value(name)" --filter='(status.conditions.status=False OR status.conditions.status=Unknown)' | tail -n +6 | while read -r revisionname; do gcloud run revisions delete --project=asdf --region=asia-east1 --quiet $revisionname ; done",
+          "gcloud artifacts docker images list asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www --sort-by=~CREATE_TIME --format="value(version)" | tail -n +7 | while read -r version; do gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www@$version --quiet --delete-tags; done",
+          "echo -e "\\e[0Ksection_end:$(date +%s):cleanup\\r\\e[0K"",
           "echo Uploading SBOM to Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/www" "https://pan-test-app-prod-www-unknown-host.example.com" "__sbom.json" vex.json || true",
         ],
@@ -1482,21 +1511,28 @@ _ALL_ENV_VAR_KEYS: '["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_ID","BUILD_INF
           },
         ],
         "script": [
+          "echo -e "\\e[0Ksection_start:$(date +%s):prepare[collapsed=true]\\r\\e[0KPrepare..."",
           "echo $CL_stage_www_GCLOUD_DEPLOY_credentialsKey > ./____keyfile.json
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe asdf --format="value(projectNumber)")",
           "echo "GCLOUD_PROJECT_NUMBER: $GCLOUD_PROJECT_NUMBER"",
-          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0Kpushing image to artifacts registry"",
+          "echo -e "\\e[0Ksection_end:$(date +%s):prepare\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):pushToArtifactRegistry[collapsed=true]\\r\\e[0KPushing image to artifacts registry"",
           "docker login --username gitlab-ci-token --password $CI_JOB_TOKEN $CI_REGISTRY",
           "gcloud auth configure-docker asia-east1-docker.pkg.dev",
           "docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG",
           "docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www:$DOCKER_IMAGE_TAG",
           "docker push asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www:$DOCKER_IMAGE_TAG",
           "echo -e "\\e[0Ksection_end:$(date +%s):pushToArtifactRegistry\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):deploy[collapsed=true]\\r\\e[0KDeploy to cloud run"",
           "echo "$ENV_VARS" > ____envvars.yaml",
           "gcloud run deploy pan-test-app-stage-www --command="yarn,start" --image=asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www:$DOCKER_IMAGE_TAG --project=asdf --region=asia-east1 --labels=customer-name=pan,component-name=www,app-name=test-app,env-type=stage,env-name=stage,build-type=node --env-vars-file=____envvars.yaml --min-instances=0 --max-instances=100 --cpu-throttling --allow-unauthenticated --cpu-boost",
-          "docker image rm asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www:$DOCKER_IMAGE_TAG",
+          "echo -e "\\e[0Ksection_end:$(date +%s):deploy\\r\\e[0K"",
+          "echo -e "\\e[0Ksection_start:$(date +%s):cleanup[collapsed=true]\\r\\e[0KCleanup"",
+          "gcloud run revisions list --project=asdf --region=asia-east1 --service=pan-test-app-stage-www --limit=unlimited --sort-by=metadata.creationTimestamp --format="value(name)" --filter='(status.conditions.status=False OR status.conditions.status=Unknown)' | while read -r revisionname; do gcloud run revisions delete --project=asdf --region=asia-east1 --quiet $revisionname ; done",
+          "gcloud artifacts docker images list asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www --sort-by=~CREATE_TIME --format="value(version)" | tail -n +2 | while read -r version; do gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www@$version --quiet --delete-tags; done",
+          "echo -e "\\e[0Ksection_end:$(date +%s):cleanup\\r\\e[0K"",
           "echo Uploading SBOM to Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" upload "pan-test-app/www" "https://pan-test-app-stage-www-unknown-host.example.com" "__sbom.json" vex.json || true",
         ],
@@ -1584,6 +1620,7 @@ _ALL_ENV_VAR_KEYS: '["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_ID","BUILD_INF
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "gcloud run services delete pan-test-app-prod-www --project=asdf --region=asia-east1",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/prod/www --quiet --delete-tags",
           "echo Disabling component in Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/www" "https://pan-test-app-prod-www-unknown-host.example.com" || true",
           "set -e",
@@ -1631,6 +1668,7 @@ _ALL_ENV_VAR_KEYS: '["ENV_SHORT","APP_DIR","ENV_TYPE","BUILD_INFO_ID","BUILD_INF
           ",
           "gcloud auth activate-service-account --key-file="./____keyfile.json"",
           "gcloud run services delete pan-test-app-stage-www --project=asdf --region=asia-east1",
+          "gcloud artifacts docker images delete asia-east1-docker.pkg.dev/asdf/catladder-deploy/pan-test-app/stage/www --quiet --delete-tags",
           "echo Disabling component in Dependency Track",
           "/dtrackuploader https://dep.panter.swiss/ "$DT_KEY_PROD" disable "pan-test-app/www" "https://pan-test-app-stage-www-unknown-host.example.com" || true",
           "set -e",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@catladder/pipeline",
-  "version": "1.115.0",
+  "version": "1.117.0",
   "scripts": {
     "build:tsc": "yarn tsc",
     "build": "yarn build:compile && yarn build:inline-variables && yarn build:bundle",

package/src/deploy/cloudRun/artifactsRegistry.ts

@@ -0,0 +1,119 @@
+import { gitlabDockerLogin } from "../../build/docker";
+import type { Context } from "../../types/context";
+import { allowFailureInScripts } from "../../utils/gitlab";
+import { isOfDeployType } from "../types";
+import { removeFirstLinesFromCommandOutput } from "./utils/removeFirstLinesFromCommandOutput";
+
+/**
+ *
+ * lecacyReviewImageName is only temporary. In old versions the images had no reviewslug in review apps, which makes cleanup harder. We delete all those images now, but need the path
+ */
+export const getArtifactsRegistryImageName = (
+  context: Context,
+  lecacyReviewImageName = false
+) => {
+  const deployConfig = context.componentConfig.deploy;
+
+  if (!isOfDeployType(deployConfig, "google-cloudrun")) {
+    // should not happen
+    throw new Error("deploy config is wrong");
+  }
+
+  if (lecacyReviewImageName && context.environment.envType !== "review") {
+    throw new Error("lecacyReviewImageName is only allowed for review app");
+  }
+  const fullAppName = `${context.fullConfig.customerName}-${context.fullConfig.appName}`;
+
+  const dockerUrl = `${deployConfig.region}-docker.pkg.dev/${deployConfig.projectId}/catladder-deploy/${fullAppName}`;
+  const gcloudImagePath = [
+    dockerUrl,
+    context.environment.shortName,
+    context.componentName,
+
+    ...(context.environment.envType === "review" && !lecacyReviewImageName
+      ? [context.commitInfo?.reviewSlug]
+      : []),
+  ];
+  return gcloudImagePath.join("/");
+};
+
+export const getArtifactsRegistryImage = (context: Context) =>
+  `${getArtifactsRegistryImageName(context)}:$DOCKER_IMAGE_TAG`;
+
+/**
+ * commands to pull the image from the default registry and pushes it to google artifact registry. We might build and push directly to google artifact registry in the future
+ */
+export const getPushToArtifactsRegistryCommands = (context: Context) => {
+  const deployConfig = context.componentConfig.deploy;
+
+  if (!isOfDeployType(deployConfig, "google-cloudrun")) {
+    // should not happen
+    throw new Error("deploy config is wrong");
+  }
+
+  const fullImageName = getArtifactsRegistryImageName(context);
+
+  return [
+    gitlabDockerLogin,
+    `gcloud auth configure-docker ${deployConfig.region}-docker.pkg.dev`,
+    `docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG`,
+    `docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG ${fullImageName}:$DOCKER_IMAGE_TAG`,
+    `docker push ${fullImageName}:$DOCKER_IMAGE_TAG`,
+  ];
+};
+
+const getDeleteImageCommands = (fullImageName: string, keepNewest = 0) => {
+  if (keepNewest === 0) {
+    // no need to list tags, we delete the whole thing
+    return [
+      `gcloud artifacts docker images delete ${fullImageName} --quiet --delete-tags`,
+    ];
+  }
+  // delete unused tags
+  const listAllImagesCommand = `gcloud artifacts docker images list ${fullImageName} --sort-by=~CREATE_TIME --format="value(version)"`;
+
+  const listImagesToDeletecommand = removeFirstLinesFromCommandOutput(
+    listAllImagesCommand,
+    keepNewest
+  );
+  const deleteImageCommand = `gcloud artifacts docker images delete ${fullImageName}@$version --quiet --delete-tags`;
+
+  const deleteImagesCommand = `${listImagesToDeletecommand} | while read -r version; do ${deleteImageCommand}; done`;
+
+  return [deleteImagesCommand];
+};
+
+/**
+ * commands to delete unused images.
+ *
+ * @param context
+ * @param keep how many of the newest images to keep
+ * @returns
+ */
+export const getDeleteUnusedImagesCommands = (context: Context, keep = 0) => {
+  const deployConfig = context.componentConfig.deploy;
+  if (deployConfig === false) {
+    return [];
+  }
+  if (!isOfDeployType(deployConfig, "google-cloudrun")) {
+    // should not happen
+    throw new Error("deploy config is wrong");
+  }
+
+  const fullImageName = getArtifactsRegistryImageName(context);
+
+  return [
+    ...getDeleteImageCommands(fullImageName, keep),
+    // because a recent version of catladder had no review-slug in the image name, we have to delete those as well
+    // we can later remove this line in some months
+
+    ...(context.environment.envType === "review"
+      ? allowFailureInScripts(
+          getDeleteImageCommands(
+            getArtifactsRegistryImageName(context, true),
+            0
+          )
+        )
+      : []),
+  ];
+};

package/src/deploy/cloudRun/cleanup.ts

@@ -0,0 +1,30 @@
+import type { Context } from "../../types/context";
+import { getDeleteUnusedImagesCommands } from "./artifactsRegistry";
+import { getDeleteUnusedRevisionsCommands } from "./cloudRunRevisions";
+
+export const getRemoveOldRevisionsAndImagesCommand = (
+  context: Context,
+  when: "postDeploy" | "onStop"
+) => {
+  if (when === "onStop") {
+    // service is already deleted, so we don't need to delete old revisions, just delete all images
+    return getDeleteUnusedImagesCommands(context);
+  }
+
+  // this number only targets inactive revisions
+  const revisionsToKeep = context.environment.envType === "prod" ? 5 : 0;
+
+  // this number needs to be higher than inactive after deploy, so we add one
+  const imagesToKeep = revisionsToKeep + 1;
+
+  const deleteOldRevisionsCommands = getDeleteUnusedRevisionsCommands(
+    context,
+    revisionsToKeep
+  );
+  const deleteOldImagesCommands = getDeleteUnusedImagesCommands(
+    context,
+    imagesToKeep
+  );
+
+  return [...deleteOldRevisionsCommands, ...deleteOldImagesCommands];
+};

package/src/deploy/cloudRun/cloudRunRevisions.ts

@@ -0,0 +1,67 @@
+import type { Context } from "../../types/context";
+import { isOfDeployType } from "../types";
+import { createArgsString } from "./utils/createArgsString";
+import { getServiceName } from "./utils/getServiceName";
+import { removeFirstLinesFromCommandOutput } from "./utils/removeFirstLinesFromCommandOutput";
+
+const getListRevisionsCommand = (
+  context: Context,
+  args: {
+    filter?: string;
+    format: string;
+  }
+) => {
+  const serviceName = getServiceName(context);
+  const deployConfig = context.componentConfig.deploy;
+
+  if (!deployConfig || !isOfDeployType(deployConfig, "google-cloudrun")) {
+    // should not happen
+    throw new Error("deploy config is wrong");
+  }
+  const filterRevisionArgs = {
+    project: deployConfig.projectId,
+    region: deployConfig.region,
+    // only show inactive revisions
+    service: serviceName,
+
+    limit: "unlimited", // is actualy the default
+    "sort-by": "metadata.creationTimestamp",
+    ...args,
+  };
+
+  // this prints out all inactive images of the given app
+  return `gcloud run revisions list ${createArgsString(filterRevisionArgs)}`;
+};
+
+export const getDeleteUnusedRevisionsCommands = (
+  context: Context,
+  keep: number
+) => {
+  const deployConfig = context.componentConfig.deploy;
+  if (deployConfig === false) {
+    return [];
+  }
+  if (!isOfDeployType(deployConfig, "google-cloudrun")) {
+    // should not happen
+    throw new Error("deploy config is wrong");
+  }
+
+  // this prints out all inactive images of the given app
+  const listAllInactiveRevisionsCmd = getListRevisionsCommand(context, {
+    format: `"value(name)"`,
+    filter: `'(status.conditions.status=False OR status.conditions.status=Unknown)'`,
+  });
+  // this removes the newest `revisionsToKeep` images
+  const listRevisionsToDeleteCmd = removeFirstLinesFromCommandOutput(
+    listAllInactiveRevisionsCmd,
+    keep
+  );
+  const deleteRevisionCmd = `gcloud run revisions delete ${createArgsString({
+    project: deployConfig.projectId,
+    region: deployConfig.region,
+    quiet: true,
+  })} $revisionname `;
+
+  const deleteRevisionsCmd = `${listRevisionsToDeleteCmd} | while read -r revisionname; do ${deleteRevisionCmd}; done`;
+  return [deleteRevisionsCmd];
+};

package/src/deploy/cloudRun/deployJob.ts

@@ -1,7 +1,7 @@
 import { dump } from "js-yaml";
 import { merge, omit } from "lodash";
 import { GCLOUD_DEPLOY_CREDENTIALS_KEY } from ".";
-import { getDockerJobBaseProps, gitlabDockerLogin } from "../../build/docker";
+import { getDockerJobBaseProps } from "../../build/docker";
 import { getLabels } from "../../context/getLabels";
 import { getRunnerImage } from "../../runner";
 import type { Context } from "../../types/context";
@@ -26,6 +26,12 @@ import {
 } from "./utils/database";
 import { gcloudServiceAccountLoginCommands } from "./utils/gcloudServiceAccountLoginCommands";
 import { getCloudRunJobName } from "./utils/jobName";
+import {
+  getArtifactsRegistryImage,
+  getPushToArtifactsRegistryCommands,
+} from "./artifactsRegistry";
+import { getServiceName } from "./utils/getServiceName";
+import { getRemoveOldRevisionsAndImagesCommand } from "./cleanup";
 
 const setExtraVarsScripts = (deployConfig: DeployConfigCloudRun) => [
   `export GCLOUD_PROJECT_NUMBER=$(gcloud projects describe ${deployConfig.projectId} --format="value(projectNumber)")`,
@@ -44,29 +50,6 @@ export const createGoogleCloudRunDeployJobs = (
     throw new Error("deploy config is wrong");
   }
 
-  const fullAppName = `${context.fullConfig.customerName}-${context.fullConfig.appName}`;
-  const dockerUrl = `${deployConfig.region}-docker.pkg.dev/${deployConfig.projectId}/catladder-deploy/${fullAppName}`;
-  const gcloudImagePath = [
-    dockerUrl,
-    context.environment.shortName,
-    context.componentName,
-
-    ...(context.environment.envType === "review"
-      ? [context.commitInfo?.reviewSlug]
-      : []),
-  ];
-  const gcloudImageName = `${gcloudImagePath.join("/")}:$DOCKER_IMAGE_TAG`;
-
-  const pushImageToArtifactsRegistry = collapseableSection(
-    "pushToArtifactRegistry",
-    "pushing image to artifacts registry"
-  )([
-    gitlabDockerLogin,
-    `gcloud auth configure-docker ${deployConfig.region}-docker.pkg.dev`,
-    `docker pull $DOCKER_IMAGE:$DOCKER_IMAGE_TAG`,
-    `docker tag $DOCKER_IMAGE:$DOCKER_IMAGE_TAG ${gcloudImageName}`,
-    `docker push ${gcloudImageName}`,
-  ]);
   const allEnvVars = omit(
     context.environment.envVars,
     GCLOUD_DEPLOY_CREDENTIALS_KEY
@@ -82,7 +65,7 @@ export const createGoogleCloudRunDeployJobs = (
   };
 
   const commonDeployArgs = {
-    image: gcloudImageName,
+    image: getArtifactsRegistryImage(context),
     ...commonArgs,
     "set-cloudsql-instances": deployConfig.cloudSql
       ? deployConfig.cloudSql.instanceConnectionName
@@ -90,7 +73,7 @@ export const createGoogleCloudRunDeployJobs = (
     labels: labelsString,
   };
 
-  const serviceName = context.environment.fullName.toLowerCase();
+  const serviceName = getServiceName(context);
 
   const getFullJobName = (name: string) =>
     getCloudRunJobName(context.environment.fullName, name);
@@ -228,26 +211,43 @@ export const createGoogleCloudRunDeployJobs = (
     ]);
 
   const deployScripts = [
-    ...gcloudServiceAccountLoginCommands(context),
-    ...setExtraVarsScripts(deployConfig),
-    ...pushImageToArtifactsRegistry,
-    `echo "$ENV_VARS" > ____envvars.yaml`, // TODO: split secrets out
-    ...(deployConfig.cloudSql
-      ? getDatabaseCreateScript(context, deployConfig) // we create the db, so that we can also delete it afterwards
-      : []),
-    ...getCreateScheduleScripts(),
-    ...getJobCreateScripts(),
-    ...getJobRunScripts("preDeploy"),
+    ...collapseableSection(
+      "prepare",
+      "Prepare..."
+    )([
+      ...gcloudServiceAccountLoginCommands(context),
+      ...setExtraVarsScripts(deployConfig),
+    ]),
+    ...collapseableSection(
+      "pushToArtifactRegistry",
+      "Pushing image to artifacts registry"
+    )(getPushToArtifactsRegistryCommands(context)),
+    ...collapseableSection(
+      "deploy",
+      "Deploy to cloud run"
+    )([
+      `echo "$ENV_VARS" > ____envvars.yaml`, // TODO: split secrets out
+      ...(deployConfig.cloudSql
+        ? getDatabaseCreateScript(context, deployConfig) // we create the db, so that we can also delete it afterwards
+        : []),
+      ...getCreateScheduleScripts(),
+      ...getJobCreateScripts(),
+      ...getJobRunScripts("preDeploy"),
 
-    ...(deployConfig.service !== false
-      ? [getServiceDeployScript(deployConfig.service)]
-      : []),
-    ...Object.entries(deployConfig.additionalServices ?? {}).map(
-      ([name, service]) => getServiceDeployScript(service, "-" + name)
+      ...(deployConfig.service !== false
+        ? [getServiceDeployScript(deployConfig.service)]
+        : []),
+      ...Object.entries(deployConfig.additionalServices ?? {}).map(
+        ([name, service]) => getServiceDeployScript(service, "-" + name)
+      ),
+      ...getJobRunScripts("postDeploy"),
+    ]),
+    ...collapseableSection(
+      "cleanup",
+      "Cleanup"
+    )(
+      getRemoveOldRevisionsAndImagesCommand(context, "postDeploy") // we cleanup inactive images both on deploy and stop
     ),
-    ...getJobRunScripts("postDeploy"),
-
-    `docker image rm ${gcloudImageName}`,
     ...getDependencyTrackUploadScript(context),
   ];
 
@@ -265,6 +265,8 @@ export const createGoogleCloudRunDeployJobs = (
     ...(deployConfig.cloudSql && deployConfig.cloudSql.deleteDatabaseOnStop
       ? getDatabaseDeleteScript(context, deployConfig)
       : []),
+
+    ...getRemoveOldRevisionsAndImagesCommand(context, "onStop"), // we cleanup inactive images both on deploy and stop
     ...getDependencyTrackDeleteScript(context),
   ];
   return createDeployementJobs(context, {

package/src/deploy/cloudRun/utils/getServiceName.ts

@@ -0,0 +1,3 @@
+import type { Context } from "../../../types/context";
+export const getServiceName = (context: Context) =>
+  context.environment.fullName.toLowerCase();

package/src/deploy/cloudRun/utils/removeFirstLinesFromCommandOutput.ts

@@ -0,0 +1,12 @@
+/**
+ *
+ * takes a command and removes the first keep lines from the output
+ *
+ * @param cmd the command, its stdout is then limited
+ * @param removeFirstN how many lines to remove at the start of the command
+ * @returns
+ */
+export const removeFirstLinesFromCommandOutput = (
+  cmd: string,
+  removeFirstN: number
+) => (removeFirstN === 0 ? cmd : `${cmd} | tail -n +${removeFirstN + 1}`);