ghcr-cleanup-manager 1.1.0

package/dist/execute/_plan-executor.js

@@ -0,0 +1,69 @@
+import { DeletePlanValidationStatuses } from "../db/index.js";
+import { deletePackageVersion } from "./_package-version-delete-client.js";
+import { untagRootTags } from "./_untag-client.js";
+export async function executeDeletePlan(plan, options) {
+    let deletedPackageVersionCount = 0;
+    let detachedTagCount = 0;
+    const directTargetTagSet = new Set(plan.directTargetTags);
+    const deletedVersionIds = new Set();
+    for (const decision of plan.rootDecisions) {
+        if (decision.validationStatus !== DeletePlanValidationStatuses.untagOnly) {
+            continue;
+        }
+        if (!options.listRootTags) {
+            throw new Error(`execution requires listRootTags support for untag-only root ${decision.digest}`);
+        }
+        const selectedTags = options
+            .listRootTags({
+            owner: plan.owner,
+            packageName: plan.packageName,
+            versionId: decision.versionId,
+            digest: decision.digest
+        })
+            .filter((tag) => directTargetTagSet.has(tag));
+        if (selectedTags.length === 0) {
+            throw new Error(`no selected tags resolved for untag-only root ${decision.digest}`);
+        }
+        detachedTagCount += await untagRootTags(plan.owner, plan.packageName, decision.versionId, decision.digest, selectedTags, options);
+    }
+    const closureMembersByRootDigest = new Map(plan.fullyDeletableRoots.map((root) => [
+        root.digest,
+        plan.closureManifests
+            .filter((manifest) => manifest.sourceDigest === root.digest)
+            .sort((left, right) => {
+            if (left.hopsFromRoot !== right.hopsFromRoot) {
+                return right.hopsFromRoot - left.hopsFromRoot;
+            }
+            return left.memberVersionId - right.memberVersionId;
+        })
+    ]));
+    for (const root of plan.fullyDeletableRoots) {
+        const closureMembers = closureMembersByRootDigest.get(root.digest) ?? [];
+        const deleteTargets = closureMembers.length > 0
+            ? closureMembers.map((member) => ({
+                versionId: member.memberVersionId,
+                digest: member.memberDigest
+            }))
+            : [{ versionId: root.versionId, digest: root.digest }];
+        for (const target of deleteTargets) {
+            if (deletedVersionIds.has(target.versionId)) {
+                continue;
+            }
+            options.logger.info(`Deleting package version ${target.versionId} for ${plan.owner}/${plan.packageName} (${target.digest})`);
+            await deletePackageVersion(plan.owner, plan.packageName, target.versionId, options.token, options.logger, {
+                fetchImpl: options.fetchImpl
+            });
+            deletedVersionIds.add(target.versionId);
+            deletedPackageVersionCount += 1;
+        }
+    }
+    return {
+        owner: plan.owner,
+        packageName: plan.packageName,
+        scanCompletedAt: plan.scanCompletedAt,
+        plannerInputs: plan.plannerInputs,
+        deletedPackageVersionCount,
+        detachedTagCount,
+        blockedRoots: plan.blockedRoots
+    };
+}

package/dist/execute/_registry-manifest-client.d.ts

@@ -0,0 +1,12 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export interface LoadedRegistryManifest {
+    digest: string;
+    mediaType: string;
+    rawJson: string;
+}
+export declare function loadRegistryManifestByDigest(owner: string, packageName: string, digest: string, registryToken: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<LoadedRegistryManifest>;
+export declare function putRegistryManifestForTag(owner: string, packageName: string, tag: string, mediaType: string, manifestJson: string, registryToken: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<string>;

package/dist/execute/_registry-manifest-client.js

@@ -0,0 +1,79 @@
+import { ghcrRegistryBaseUrl } from "../config/index.js";
+import { createHash } from "node:crypto";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, resolveJsonHeaders, runWithRetry } from "./_http.js";
+const _ACCEPTED_MANIFEST_MEDIA_TYPES = [
+    "application/vnd.oci.image.index.v1+json",
+    "application/vnd.oci.image.manifest.v1+json",
+    "application/vnd.docker.distribution.manifest.list.v2+json",
+    "application/vnd.docker.distribution.manifest.v2+json",
+    "application/vnd.oci.artifact.manifest.v1+json"
+].join(", ");
+export async function loadRegistryManifestByDigest(owner, packageName, digest, registryToken, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const url = new URL(`/v2/${owner}/${packageName}/manifests/${digest}`, ghcrRegistryBaseUrl);
+    let response;
+    try {
+        response = await runWithRetry(`GHCR manifest request for ${digest}`, logger, async () => {
+            const manifestResponse = await fetchImpl(url.toString(), {
+                headers: {
+                    Accept: _ACCEPTED_MANIFEST_MEDIA_TYPES,
+                    Authorization: `Bearer ${registryToken}`,
+                    "User-Agent": "ghcr-cleanup-manager"
+                }
+            });
+            if (!manifestResponse.ok && isRetryableStatus(manifestResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(manifestResponse, `GHCR manifest request for ${digest} failed`));
+            }
+            return manifestResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GHCR manifest request for ${digest} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GHCR manifest request for ${digest} failed`));
+    }
+    const document = (await response.json());
+    const mediaType = document.mediaType ?? resolveJsonHeaders(response);
+    if (!mediaType) {
+        throw new Error(`manifest response for ${digest} did not include a media type`);
+    }
+    return {
+        digest,
+        mediaType,
+        rawJson: JSON.stringify(document)
+    };
+}
+export async function putRegistryManifestForTag(owner, packageName, tag, mediaType, manifestJson, registryToken, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const url = new URL(`/v2/${owner}/${packageName}/manifests/${encodeURIComponent(tag)}`, ghcrRegistryBaseUrl);
+    let response;
+    try {
+        response = await runWithRetry(`GHCR manifest put request for tag ${tag}`, logger, async () => {
+            const putResponse = await fetchImpl(url.toString(), {
+                method: "PUT",
+                headers: {
+                    Authorization: `Bearer ${registryToken}`,
+                    "Content-Type": mediaType,
+                    "User-Agent": "ghcr-cleanup-manager"
+                },
+                body: manifestJson
+            });
+            if (!putResponse.ok && isRetryableStatus(putResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(putResponse, `GHCR manifest put request for tag ${tag} failed`));
+            }
+            return putResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, `GHCR manifest put request for tag ${tag} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GHCR manifest put request for tag ${tag} failed`));
+    }
+    return `sha256:${createHash("sha256").update(manifestJson).digest("hex")}`;
+}

package/dist/execute/_registry-token-client.d.ts

@@ -0,0 +1,4 @@
+import type { DeleteExecutionLogger, GitHubPackageFetch } from "./_types.js";
+export declare function loadRegistryPushToken(owner: string, packageName: string, token: string, logger: DeleteExecutionLogger, runtime?: {
+    fetchImpl?: GitHubPackageFetch;
+}): Promise<string>;

package/dist/execute/_registry-token-client.js

@@ -0,0 +1,37 @@
+import { ghcrRegistryBaseUrl } from "../config/index.js";
+import { buildHttpErrorMessage, buildTransportErrorMessage, isRetryableStatus, resolveFetch, runWithRetry } from "./_http.js";
+export async function loadRegistryPushToken(owner, packageName, token, logger, runtime) {
+    const fetchImpl = resolveFetch(runtime?.fetchImpl);
+    const registryUrl = new URL(ghcrRegistryBaseUrl);
+    const tokenUrl = new URL("/token", registryUrl);
+    tokenUrl.searchParams.set("service", registryUrl.host);
+    tokenUrl.searchParams.set("scope", `repository:${owner}/${packageName}:pull,push`);
+    let response;
+    try {
+        response = await runWithRetry("GHCR token request", logger, async () => {
+            const tokenResponse = await fetchImpl(tokenUrl.toString(), {
+                headers: {
+                    "User-Agent": "ghcr-cleanup-manager",
+                    Authorization: `Basic ${Buffer.from(`${owner}:${token}`).toString("base64")}`
+                }
+            });
+            if (!tokenResponse.ok && isRetryableStatus(tokenResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(tokenResponse, "GHCR token request failed"));
+            }
+            return tokenResponse;
+        });
+    }
+    catch (error) {
+        throw new Error(buildTransportErrorMessage(error, "GHCR token request failed"), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, "GHCR token request failed"));
+    }
+    const body = (await response.json());
+    if (!body.token) {
+        throw new Error("GHCR token response did not include a token");
+    }
+    return body.token;
+}

package/dist/execute/_types.d.ts

@@ -0,0 +1,34 @@
+import type { DeletePlan } from "../db/index.js";
+export interface DeleteExecutionSummary {
+    owner: string;
+    packageName: string;
+    scanCompletedAt: string;
+    plannerInputs: DeletePlan["plannerInputs"];
+    deletedPackageVersionCount: number;
+    detachedTagCount: number;
+    blockedRoots: DeletePlan["blockedRoots"];
+}
+export interface DeleteExecutionOptions {
+    token: string;
+    logger: DeleteExecutionLogger;
+    fetchImpl?: GitHubPackageFetch;
+    listRootTags?: (root: {
+        owner: string;
+        packageName: string;
+        versionId: number;
+        digest: string;
+    }) => string[];
+}
+export interface DeleteExecutionLogger {
+    debug(message: string): void;
+    info(message: string): void;
+    warn(message: string): void;
+    error(message: string): void;
+}
+export interface GitHubPackageFetchResponse {
+    ok: boolean;
+    status: number;
+    headers: Headers;
+    json(): Promise<unknown>;
+}
+export type GitHubPackageFetch = (input: string, init?: RequestInit) => Promise<GitHubPackageFetchResponse>;

package/dist/execute/_types.js

@@ -0,0 +1 @@
+export {};

package/dist/execute/_untag-client.d.ts

@@ -0,0 +1,2 @@
+import type { DeleteExecutionOptions } from "./_types.js";
+export declare function untagRootTags(owner: string, packageName: string, sourceVersionId: number, sourceDigest: string, tags: string[], options: DeleteExecutionOptions): Promise<number>;

package/dist/execute/_untag-client.js

@@ -0,0 +1,30 @@
+import { buildDetachedManifestClone } from "./_manifest-detach.js";
+import { findPackageVersionByDigestAndTag } from "./_package-version-page-client.js";
+import { deletePackageVersion } from "./_package-version-delete-client.js";
+import { loadRegistryManifestByDigest, putRegistryManifestForTag } from "./_registry-manifest-client.js";
+import { loadRegistryPushToken } from "./_registry-token-client.js";
+export async function untagRootTags(owner, packageName, sourceVersionId, sourceDigest, tags, options) {
+    const registryToken = await loadRegistryPushToken(owner, packageName, options.token, options.logger, {
+        fetchImpl: options.fetchImpl
+    });
+    const sourceManifest = await loadRegistryManifestByDigest(owner, packageName, sourceDigest, registryToken, options.logger, {
+        fetchImpl: options.fetchImpl
+    });
+    for (const tag of tags) {
+        options.logger.info(`Detaching tag ${owner}/${packageName}:${tag} from ${sourceDigest}`);
+        const detachedManifestJson = buildDetachedManifestClone(sourceManifest.rawJson, sourceManifest.mediaType, {
+            detachedTag: tag,
+            sourceDigest
+        });
+        const detachedDigest = await putRegistryManifestForTag(owner, packageName, tag, sourceManifest.mediaType, detachedManifestJson, registryToken, options.logger, {
+            fetchImpl: options.fetchImpl
+        });
+        const detachedVersionId = await findPackageVersionByDigestAndTag(owner, packageName, detachedDigest, tag, options.token, options.logger, {
+            fetchImpl: options.fetchImpl
+        });
+        await deletePackageVersion(owner, packageName, detachedVersionId, options.token, options.logger, {
+            fetchImpl: options.fetchImpl
+        });
+    }
+    return tags.length;
+}

package/dist/execute/index.d.ts

@@ -0,0 +1,5 @@
+export { executeDeletePlan } from "./_plan-executor.js";
+export { listPackageVersionTagSources, listPresentPackageVersionIds } from "./_package-version-tag-source-client.js";
+export { untagRootTags } from "./_untag-client.js";
+export type { GitHubPackageVersionTagSource } from "./_package-version-tag-source-client.js";
+export type { DeleteExecutionSummary } from "./_types.js";

package/dist/execute/index.js

@@ -0,0 +1,3 @@
+export { executeDeletePlan } from "./_plan-executor.js";
+export { listPackageVersionTagSources, listPresentPackageVersionIds } from "./_package-version-tag-source-client.js";
+export { untagRootTags } from "./_untag-client.js";

package/dist/ingest/github/_manifest-client.d.ts

@@ -0,0 +1,14 @@
+import type { ManifestDescriptorRecord, ManifestEdgeRecord, ManifestRecord } from "../../core/index.js";
+import { type FetchLike, type GitHubScanOptions } from "./_shared.js";
+type _LoadedManifestRecord = Omit<ManifestRecord, "versionId">;
+export declare function loadManifestGraph(fetchImpl: FetchLike, registryBaseUrl: string, digest: string, registryToken: string, options: GitHubScanOptions): Promise<{
+    record: _LoadedManifestRecord;
+    descriptorRecords: ManifestDescriptorRecord[];
+    edgeRecords: ManifestEdgeRecord[];
+    rawJson: string;
+}>;
+export declare function buildManifestRelations(digest: string, rawJson: string): {
+    descriptorRecords: ManifestDescriptorRecord[];
+    edgeRecords: ManifestEdgeRecord[];
+};
+export {};

package/dist/ingest/github/_manifest-client.js

@@ -0,0 +1,108 @@
+import { classifyManifestKind } from "./_manifest-kind.js";
+import { acceptedManifestMediaTypes, buildFetchTransportErrorMessage, buildHttpErrorMessage, withFetchRetry } from "./_shared.js";
+export async function loadManifestGraph(fetchImpl, registryBaseUrl, digest, registryToken, options) {
+    const startTime = Date.now();
+    const url = new URL(`/v2/${options.owner}/${options.packageName}/manifests/${digest}`, registryBaseUrl);
+    let response;
+    try {
+        response = await withFetchRetry(async () => {
+            const manifestResponse = await fetchImpl(url.toString(), {
+                headers: {
+                    Accept: acceptedManifestMediaTypes,
+                    Authorization: `Bearer ${registryToken}`,
+                    "User-Agent": "ghcr-cleanup-manager"
+                }
+            });
+            if (!manifestResponse.ok && _shouldRetryStatus(manifestResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(manifestResponse, `GHCR manifest request for ${digest} failed`));
+            }
+            return manifestResponse;
+        }, {
+            logger: options.logger,
+            label: `GHCR manifest request for ${digest}`,
+            shouldRetry: (error) => _shouldRetryError(error)
+        });
+    }
+    catch (error) {
+        throw new Error(buildFetchTransportErrorMessage(error, `GHCR manifest request for ${digest} failed`), {
+            cause: error
+        });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, `GHCR manifest request for ${digest} failed`));
+    }
+    const mediaTypeHeader = response.headers.get("content-type")?.split(";")[0];
+    const document = (await response.json());
+    const rawJson = JSON.stringify(document);
+    const mediaType = document.mediaType ?? mediaTypeHeader;
+    if (!mediaType) {
+        throw new Error(`manifest response for ${digest} did not include a media type`);
+    }
+    options.logger.debug(`Loaded GHCR manifest ${digest} in ${Date.now() - startTime}ms (${mediaType})`);
+    return {
+        rawJson,
+        record: {
+            digest,
+            manifestKind: classifyManifestKind(document),
+            mediaType,
+            artifactType: document.artifactType,
+            configMediaType: document.config?.mediaType,
+            subjectDigest: document.subject?.digest,
+            annotations: document.annotations
+        },
+        ...buildManifestRelations(digest, rawJson)
+    };
+}
+export function buildManifestRelations(digest, rawJson) {
+    const document = JSON.parse(rawJson);
+    return {
+        descriptorRecords: _buildDescriptorRecords(digest, document),
+        edgeRecords: _buildEdges(digest, document)
+    };
+}
+function _buildDescriptorRecords(parentDigest, document) {
+    const records = [];
+    for (const child of document.manifests ?? []) {
+        if (!child.digest || !child.mediaType) {
+            continue;
+        }
+        records.push({
+            parentDigest,
+            childDigest: child.digest,
+            mediaType: child.mediaType,
+            artifactType: child.artifactType,
+            platform: child.platform
+        });
+    }
+    return records;
+}
+function _buildEdges(parentDigest, document) {
+    const edges = [];
+    for (const child of document.manifests ?? []) {
+        if (!child.digest || !child.mediaType) {
+            continue;
+        }
+        edges.push({
+            parentDigest,
+            childDigest: child.digest,
+            edgeKind: "image-child"
+        });
+    }
+    if (document.subject?.digest) {
+        edges.push({
+            parentDigest: document.subject.digest,
+            childDigest: parentDigest,
+            edgeKind: "referrer"
+        });
+    }
+    return edges;
+}
+function _shouldRetryStatus(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
+function _shouldRetryError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    return /fetch failed|status 429|status 502|status 503|status 504/.test(error.message);
+}

package/dist/ingest/github/_manifest-ingest.d.ts

@@ -0,0 +1,3 @@
+import type { ScanWriter, SnapshotRepository } from "../../db/index.js";
+import { type FetchLike, type GitHubScanOptions } from "./_shared.js";
+export declare function ingestManifests(fetchImpl: FetchLike, registryBaseUrl: string, options: GitHubScanOptions, writer: ScanWriter, repository: SnapshotRepository, scanId: number): Promise<void>;

package/dist/ingest/github/_manifest-ingest.js

@@ -0,0 +1,90 @@
+import { manifestFetchConcurrency, manifestIngestProgressStepRatio } from "../../config/index.js";
+import { buildManifestRelations, loadManifestGraph } from "./_manifest-client.js";
+import { loadRegistryPullToken } from "./_registry-token-client.js";
+export async function ingestManifests(fetchImpl, registryBaseUrl, options, writer, repository, scanId) {
+    const manifests = repository.listPackageVersionManifestRefs(scanId);
+    const totalDigestCount = manifests.length;
+    const progressStep = Math.max(1, Math.ceil(totalDigestCount * manifestIngestProgressStepRatio));
+    const registryPullTokenState = {};
+    options.logger.info(`Fetching manifests for ${totalDigestCount} package versions`);
+    let completed = 0;
+    let nextManifestIndex = 0;
+    const activeLoads = new Set();
+    while (nextManifestIndex < manifests.length || activeLoads.size > 0) {
+        while (nextManifestIndex < manifests.length && activeLoads.size < manifestFetchConcurrency) {
+            const load = _fetchManifest(manifests[nextManifestIndex], fetchImpl, registryBaseUrl, options, writer, completed, async () => (await _getRegistryPullToken(fetchImpl, registryBaseUrl, options, registryPullTokenState)).token, () => {
+                completed += 1;
+                if (completed % progressStep === 0 || completed === totalDigestCount) {
+                    options.logger.info(`Fetched manifests ${completed}/${totalDigestCount}`);
+                }
+            }).finally(() => {
+                activeLoads.delete(load);
+            });
+            nextManifestIndex += 1;
+            activeLoads.add(load);
+        }
+        if (activeLoads.size > 0) {
+            await Promise.race(activeLoads);
+        }
+    }
+    _processManifestPayloads(options, writer, repository, scanId);
+}
+async function _fetchManifest(manifestRef, fetchImpl, registryBaseUrl, options, writer, completed, getRegistryToken, onComplete) {
+    const { versionId, digest } = manifestRef;
+    options.logger.debug(`Fetching manifest ${completed + 1}: ${digest}`);
+    let manifest;
+    try {
+        manifest = await loadManifestGraph(fetchImpl, registryBaseUrl, digest, await getRegistryToken(), options);
+    }
+    catch (error) {
+        if (_isMissingManifestError(error)) {
+            options.logger.warn(`Skipping missing GHCR manifest ${digest}`);
+            onComplete();
+            return;
+        }
+        throw error;
+    }
+    writer.insertManifest({ versionId, ...manifest.record });
+    writer.insertManifestPayload(manifest.record.digest, manifest.rawJson);
+    onComplete();
+}
+function _processManifestPayloads(options, writer, repository, scanId) {
+    const digests = new Set(repository.listManifestDigests(scanId));
+    const payloads = repository.listManifestPayloads(scanId);
+    options.logger.info(`Starting manifest graph processing for ${payloads.length} manifest payloads`);
+    let persistedEdgeCount = 0;
+    for (const payload of payloads) {
+        const relations = buildManifestRelations(payload.digest, payload.rawJson);
+        for (const descriptor of relations.descriptorRecords) {
+            writer.insertManifestDescriptor(descriptor);
+        }
+        for (const edge of relations.edgeRecords) {
+            if (digests.has(edge.parentDigest) && digests.has(edge.childDigest)) {
+                writer.insertManifestEdge(edge);
+                persistedEdgeCount += 1;
+            }
+        }
+    }
+    options.logger.info(`Inserted ${persistedEdgeCount} manifest edges; rebuilding reachability`);
+    writer.rebuildManifestReachability();
+    options.logger.info("Completed manifest graph processing");
+}
+function _isMissingManifestError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    return /GHCR manifest request .* failed - status 404/.test(error.message);
+}
+async function _getRegistryPullToken(fetchImpl, registryBaseUrl, options, registryPullTokenState) {
+    if (registryPullTokenState.token && Date.now() < registryPullTokenState.token.expiresAt - 5000) {
+        return registryPullTokenState.token;
+    }
+    if (!registryPullTokenState.load) {
+        registryPullTokenState.load = loadRegistryPullToken(fetchImpl, registryBaseUrl, options).finally(() => {
+            registryPullTokenState.load = undefined;
+        });
+    }
+    const registryPullToken = await registryPullTokenState.load;
+    registryPullTokenState.token = registryPullToken;
+    return registryPullToken;
+}

package/dist/ingest/github/_manifest-kind.d.ts

@@ -0,0 +1,26 @@
+import { type ManifestKind } from "../../core/index.js";
+interface _RegistryLayer {
+    mediaType?: string;
+    annotations?: Record<string, unknown>;
+}
+interface _RegistryManifestDocument {
+    mediaType?: string;
+    artifactType?: string;
+    annotations?: Record<string, unknown>;
+    manifests?: Array<{
+        platform?: {
+            architecture?: string;
+            os?: string;
+        };
+    }>;
+    config?: {
+        mediaType?: string;
+        artifactType?: string;
+    };
+    layers?: _RegistryLayer[];
+    subject?: {
+        digest?: string;
+    };
+}
+export declare function classifyManifestKind(document: _RegistryManifestDocument): ManifestKind | undefined;
+export {};

package/dist/ingest/github/_manifest-kind.js

@@ -0,0 +1,65 @@
+import { ManifestKinds } from "../../core/index.js";
+export function classifyManifestKind(document) {
+    if (document.mediaType === "application/vnd.oci.image.index.v1+json" ||
+        document.mediaType === "application/vnd.docker.distribution.manifest.list.v2+json") {
+        return _isMultiArchManifest(document) ? ManifestKinds.multiArchManifest : ManifestKinds.indexManifest;
+    }
+    if (_isSignatureManifest(document)) {
+        return ManifestKinds.signatureManifest;
+    }
+    if (_isAttestationManifest(document)) {
+        return ManifestKinds.attestationManifest;
+    }
+    if (document.mediaType === "application/vnd.oci.image.manifest.v1+json" ||
+        document.mediaType === "application/vnd.docker.distribution.manifest.v2+json") {
+        return ManifestKinds.imageManifest;
+    }
+    if (document.mediaType === "application/vnd.oci.artifact.manifest.v1+json") {
+        return ManifestKinds.artifactManifest;
+    }
+    return undefined;
+}
+function _isMultiArchManifest(document) {
+    const realPlatformDescriptorCount = document.manifests?.filter((descriptor) => {
+        const architecture = descriptor.platform?.architecture;
+        const os = descriptor.platform?.os;
+        return (typeof architecture === "string" &&
+            typeof os === "string" &&
+            architecture.length > 0 &&
+            os.length > 0 &&
+            architecture !== "unknown" &&
+            os !== "unknown");
+    }).length ?? 0;
+    return realPlatformDescriptorCount > 1;
+}
+function _isSignatureManifest(document) {
+    const candidates = [
+        document.artifactType,
+        document.config?.artifactType,
+        document.config?.mediaType,
+        ...(document.layers?.map((layer) => layer.mediaType) ?? [])
+    ];
+    if (candidates.some((value) => typeof value === "string" && value.includes("application/vnd.dev.sigstore"))) {
+        return true;
+    }
+    return (typeof document.annotations?.["dev.sigstore.bundle.predicateType"] === "string" &&
+        document.annotations["dev.sigstore.bundle.predicateType"] === "https://sigstore.dev/cosign/sign/v1");
+}
+function _isAttestationManifest(document) {
+    const candidates = [
+        document.artifactType,
+        document.config?.artifactType,
+        document.config?.mediaType,
+        ...(document.layers?.map((layer) => layer.mediaType) ?? [])
+    ];
+    if (candidates.some((value) => typeof value === "string" && value.includes("application/vnd.in-toto"))) {
+        return true;
+    }
+    if (typeof document.annotations?.["vnd.docker.reference.type"] === "string") {
+        return document.annotations["vnd.docker.reference.type"] === "attestation-manifest";
+    }
+    if (typeof document.annotations?.["dev.sigstore.bundle.predicateType"] === "string") {
+        return document.annotations["dev.sigstore.bundle.predicateType"] !== "https://sigstore.dev/cosign/sign/v1";
+    }
+    return (document.layers?.some((layer) => typeof layer.annotations?.["in-toto.io/predicate-type"] === "string") ?? false);
+}

package/dist/ingest/github/_package-metadata-load.d.ts

@@ -0,0 +1,5 @@
+import { type FetchLike, type GitHubScanOptions } from "./_shared.js";
+export interface GitHubPackageMetadata {
+    rawJson: string;
+}
+export declare function loadPackageMetadata(fetchImpl: FetchLike, options: GitHubScanOptions): Promise<GitHubPackageMetadata>;

package/dist/ingest/github/_package-metadata-load.js

@@ -0,0 +1,45 @@
+import { githubApiBaseUrl, githubApiVersion } from "../../config/index.js";
+import { getOwnerURIComponent } from "../../core/index.js";
+import { buildFetchTransportErrorMessage, buildHttpErrorMessage, withFetchRetry } from "./_shared.js";
+export async function loadPackageMetadata(fetchImpl, options) {
+    const ownerURIComponent = await getOwnerURIComponent(fetchImpl, options.owner, options.token, options.logger);
+    const url = new URL(`/${ownerURIComponent}/packages/container/${encodeURIComponent(options.packageName)}`, githubApiBaseUrl).toString();
+    let response;
+    try {
+        response = await withFetchRetry(async () => {
+            const packageResponse = await fetchImpl(url, {
+                headers: {
+                    Accept: "application/vnd.github+json",
+                    Authorization: `Bearer ${options.token}`,
+                    "User-Agent": "ghcr-cleanup-manager",
+                    "X-GitHub-Api-Version": githubApiVersion
+                }
+            });
+            if (!packageResponse.ok && _shouldRetryStatus(packageResponse.status)) {
+                throw new Error(await buildHttpErrorMessage(packageResponse, "GitHub package metadata request failed"));
+            }
+            return packageResponse;
+        }, {
+            logger: options.logger,
+            label: "GitHub package metadata request",
+            shouldRetry: (error) => _shouldRetryError(error)
+        });
+    }
+    catch (error) {
+        throw new Error(buildFetchTransportErrorMessage(error, "GitHub package metadata request failed"), { cause: error });
+    }
+    if (!response.ok) {
+        throw new Error(await buildHttpErrorMessage(response, "GitHub package metadata request failed"));
+    }
+    const payload = (await response.json());
+    return { rawJson: JSON.stringify(payload) };
+}
+function _shouldRetryStatus(status) {
+    return status === 429 || status === 502 || status === 503 || status === 504;
+}
+function _shouldRetryError(error) {
+    if (!(error instanceof Error)) {
+        return false;
+    }
+    return /fetch failed|status 429|status 502|status 503|status 504/.test(error.message);
+}