ghcr-manager 0.9.4 → 0.9.6

package/dist/db/planner/_planner-types.d.ts

@@ -2,8 +2,8 @@ interface _PlanRootRow {
     version_id: number;
     root_digest: string;
     root_manifest_kind: string | null;
-    direct_target_reason: string;
-    selection_mode: string;
+    direct_target_reason: DeletePlanSelectionReason;
+    selection_mode: DeletePlanSelectionMode;
 }
 interface _PlanTagRow {
     target_tag: string;
@@ -24,7 +24,7 @@ interface _BlockedRootRow {
     blocking_digest: string;
     overlap_digest: string;
     overlap_manifest_kind: string | null;
-    block_reason: string;
+    block_reason: DeletePlanBlockReasonCode;
 }
 export interface PlannerLogger {
     trace(message: string): void;
@@ -37,12 +37,15 @@ export interface ScanRow {
     package_name: string;
     scan_completed_at: string;
 }
+export type DeletePlanSelectionMode = "delete-root" | "untag-only";
+export type DeletePlanSelectionReason = "delete-tags-all-tags-selected" | "delete-tags-partial-tag-match" | "delete-untagged" | "keep-n-tagged-overflow" | "keep-n-untagged-overflow";
+export type DeletePlanBlockReasonCode = "overlap-with-retained-root";
 export interface DeletePlanRoot {
     versionId: number;
     digest: string;
     manifestKind?: string;
-    reason: string;
-    selectionMode: string;
+    reason: DeletePlanSelectionReason;
+    selectionMode: DeletePlanSelectionMode;
 }
 export interface DeletePlanClosureManifest {
     sourceVersionId: number;
@@ -60,14 +63,14 @@ export interface DeletePlanBlockedRoot {
     blockingDigest: string;
     overlapDigest: string;
     overlapManifestKind?: string;
-    reason: string;
+    reason: DeletePlanBlockReasonCode;
 }
 export interface DeletePlanRootDecision {
     versionId: number;
     digest: string;
     manifestKind?: string;
-    selectionMode: string;
-    selectionReason: string;
+    selectionMode: DeletePlanSelectionMode;
+    selectionReason: DeletePlanSelectionReason;
     validationStatus: "fully-deletable" | "blocked" | "untag-only";
     validationReasonCode: "untag-only-partial-tag-match" | "fully-deletable-no-retained-overlap" | "blocked-overlap-with-retained-root";
     validationReason: string;
@@ -82,7 +85,7 @@ export interface DeletePlanProtectedRoot {
     blocks: Array<{
         blockedVersionId: number;
         blockedDigest: string;
-        blockReasonCode: string;
+        blockReasonCode: DeletePlanBlockReasonCode;
         overlapDigest: string;
         overlapManifestKind?: string;
     }>;
@@ -109,15 +112,6 @@ export interface DeletePlan {
         olderThan?: string;
         cutoffTimestamp?: string;
     };
-    validationSummary: {
-        directTargetTagCount: number;
-        directTargetRootCount: number;
-        deleteRootCandidateCount: number;
-        untagOnlyRootCount: number;
-        fullyDeletableRootCount: number;
-        blockedDeleteRootCount: number;
-        protectedRootCount: number;
-    };
     directTargetTags: string[];
     directTargetRoots: DeletePlanRoot[];
     rootDecisions: DeletePlanRootDecision[];

package/dist/db/planner/index.d.ts

@@ -1,2 +1,2 @@
 export { PlannerRepository } from "./_planner-repository.js";
-export type { DeletePlan, DeletePlanBlockedRoot, DeletePlanClosureManifest, DeletePlanProtectedRoot, DeletePlanRoot, DeletePlanRootDecision } from "./_planner-repository.js";
+export type { DeletePlan, DeletePlanBlockReasonCode, DeletePlanBlockedRoot, DeletePlanClosureManifest, DeletePlanProtectedRoot, DeletePlanRoot, DeletePlanRootDecision, DeletePlanSelectionMode, DeletePlanSelectionReason } from "./_planner-repository.js";

package/package.json

@@ -9,7 +9,7 @@
     "type": "git",
     "url": "https://github.com/gh-workflow/ghcr-manager"
   },
-  "version": "0.9.4",
+  "version": "0.9.6",
   "type": "module",
   "engines": {
     "node": ">=20.0.0"

package/resources/sql/schema/001_schema.sql

@@ -34,6 +34,8 @@ CREATE TABLE IF NOT EXISTS tags (
   scan_id INTEGER NOT NULL,
   tag TEXT NOT NULL,
   version_id INTEGER NOT NULL,
+  is_digest_tag INTEGER NOT NULL,
+  CHECK(is_digest_tag IN (0, 1)),
   PRIMARY KEY(scan_id, tag),
   FOREIGN KEY(scan_id, version_id) REFERENCES package_versions(scan_id, version_id)
 );
@@ -89,6 +91,7 @@ CREATE TABLE IF NOT EXISTS manifest_edges (
   parent_digest TEXT NOT NULL,
   child_digest TEXT NOT NULL,
   edge_kind TEXT NOT NULL,
+  CHECK(edge_kind IN ('image-child', 'referrer', 'digest-tag-referrer')),
   PRIMARY KEY(scan_id, parent_digest, child_digest, edge_kind),
   FOREIGN KEY(scan_id, parent_digest) REFERENCES manifests(scan_id, digest),
   FOREIGN KEY(scan_id, child_digest) REFERENCES manifests(scan_id, digest)
@@ -137,6 +140,14 @@ CREATE TABLE IF NOT EXISTS cleanup_root_decisions (
   blocking_digest TEXT,
   overlap_digest TEXT,
   PRIMARY KEY(cleanup_run_id, digest),
+  CHECK(selection_mode IN ('delete-root', 'untag-only')),
+  CHECK(selection_reason IN (
+    'delete-tags-all-tags-selected',
+    'delete-tags-partial-tag-match',
+    'delete-untagged',
+    'keep-n-tagged-overflow',
+    'keep-n-untagged-overflow'
+  )),
   CHECK(validation_status IN ('fully-deletable', 'blocked', 'untag-only')),
   CHECK(validation_reason_code IN (
     'untag-only-partial-tag-match',
@@ -149,6 +160,15 @@ CREATE TABLE IF NOT EXISTS cleanup_root_decisions (
   FOREIGN KEY(scan_id, overlap_digest) REFERENCES manifests(scan_id, digest)
 );
 
+CREATE TABLE IF NOT EXISTS cleanup_selected_tags (
+  cleanup_run_id INTEGER NOT NULL,
+  scan_id INTEGER NOT NULL,
+  tag TEXT NOT NULL,
+  PRIMARY KEY(cleanup_run_id, tag),
+  FOREIGN KEY(cleanup_run_id, scan_id) REFERENCES cleanup_runs(cleanup_run_id, scan_id),
+  FOREIGN KEY(scan_id, tag) REFERENCES tags(scan_id, tag)
+);
+
 CREATE TABLE IF NOT EXISTS cleanup_protected_root_blocks (
   cleanup_run_id INTEGER NOT NULL,
   scan_id INTEGER NOT NULL,

package/resources/sql/views/003_v_scan_root_manifests.sql

@@ -31,6 +31,7 @@ JOIN package_scans ps
 LEFT JOIN tags t
   ON t.scan_id = m.scan_id
  AND t.version_id = m.version_id
+ AND t.is_digest_tag = 0
 GROUP BY
   ps.scan_id,
   ps.owner,

package/resources/sql/views/{004_v_digest_derived_tag_relations.sql → 004_v_digest_tag_relations.sql}

@@ -1,6 +1,6 @@
-DROP VIEW IF EXISTS v_digest_derived_tag_relations;
+DROP VIEW IF EXISTS v_digest_tag_relations;
 
-CREATE VIEW v_digest_derived_tag_relations AS
+CREATE VIEW v_digest_tag_relations AS
 WITH digest_like_tags AS (
   SELECT
     lsp.scan_id,
@@ -11,7 +11,7 @@ WITH digest_like_tags AS (
     m.digest AS artifact_digest,
     m.manifest_kind AS artifact_manifest_kind,
     m.subject_digest AS artifact_subject_digest,
-    'sha256:' || SUBSTR(t.tag, 8, 64) AS inferred_parent_digest,
+    'sha256:' || SUBSTR(t.tag, 8, 64) AS parent_digest,
     SUBSTR(t.tag, 72) AS tag_suffix
   FROM tags t
   JOIN v_latest_scan_per_package lsp
@@ -32,15 +32,14 @@ SELECT
   dlt.artifact_digest,
   dlt.artifact_manifest_kind,
   dlt.artifact_subject_digest,
-  dlt.inferred_parent_digest,
+  dlt.parent_digest,
   dlt.tag_suffix,
   pm.version_id AS parent_version_id,
-  pm.digest AS parent_digest,
   pm.manifest_kind AS parent_manifest_kind,
   CASE
-    WHEN dlt.artifact_subject_digest = dlt.inferred_parent_digest THEN 1
+    WHEN dlt.artifact_subject_digest = dlt.parent_digest THEN 1
     ELSE 0
-  END AS subject_matches_inferred_parent,
+  END AS subject_matches_parent,
   CASE
     WHEN pm.digest IS NULL THEN 0
     ELSE 1
@@ -48,4 +47,4 @@ SELECT
 FROM digest_like_tags dlt
 LEFT JOIN manifests pm
   ON pm.scan_id = dlt.scan_id
- AND pm.digest = dlt.inferred_parent_digest;
+ AND pm.digest = dlt.parent_digest;

package/resources/sql/views/005_v_cleanup_root_closure_members.sql

@@ -97,4 +97,5 @@ SELECT
 FROM closure_members cm
 LEFT JOIN tags tag
   ON tag.scan_id = cm.scan_id
- AND tag.version_id = cm.member_version_id;
+ AND tag.version_id = cm.member_version_id
+ AND tag.is_digest_tag = 0;

package/resources/sql/views/007_v_cleanup_root_decision_readable.sql

@@ -0,0 +1,67 @@
+DROP VIEW IF EXISTS v_cleanup_root_decision_readable;
+
+CREATE VIEW v_cleanup_root_decision_readable AS
+WITH selected_tag_summary AS (
+  SELECT
+    selected.cleanup_run_id,
+    tag.version_id AS root_version_id,
+    COUNT(*) AS selected_tag_count,
+    GROUP_CONCAT(selected.tag, ', ') AS selected_tags
+  FROM cleanup_selected_tags selected
+  JOIN tags tag
+    ON tag.scan_id = selected.scan_id
+   AND tag.tag = selected.tag
+  GROUP BY
+    selected.cleanup_run_id,
+    tag.version_id
+)
+SELECT
+  run.cleanup_run_id,
+  run.scan_id,
+  scan.owner,
+  scan.package_name,
+  decision.digest AS root_digest,
+  root_manifest.version_id AS root_version_id,
+  root_manifest.manifest_kind AS root_manifest_kind,
+  decision.selection_mode,
+  CASE decision.selection_mode
+    WHEN 'delete-root' THEN 'delete root'
+    WHEN 'untag-only' THEN 'detach selected tags only'
+  END AS selection_mode_label,
+  decision.selection_reason,
+  CASE decision.selection_reason
+    WHEN 'delete-tags-all-tags-selected' THEN 'all tags on this root were selected'
+    WHEN 'delete-tags-partial-tag-match' THEN 'only part of this root''s tag set was selected'
+    WHEN 'delete-untagged' THEN 'root was selected because it is untagged'
+    WHEN 'keep-n-tagged-overflow' THEN 'root fell outside the tagged keep window'
+    WHEN 'keep-n-untagged-overflow' THEN 'root fell outside the untagged keep window'
+  END AS selection_reason_label,
+  decision.validation_status,
+  CASE decision.validation_status
+    WHEN 'fully-deletable' THEN 'root and closure can be deleted'
+    WHEN 'untag-only' THEN 'only selected tags can be detached'
+    WHEN 'blocked' THEN 'root deletion is blocked'
+  END AS validation_status_label,
+  decision.validation_reason_code,
+  CASE decision.validation_reason_code
+    WHEN 'fully-deletable-no-retained-overlap' THEN 'no retained root overlaps this closure'
+    WHEN 'untag-only-partial-tag-match' THEN 'matched tags cover only part of the root tag set'
+    WHEN 'blocked-overlap-with-retained-root' THEN 'a retained root still requires an overlapping manifest'
+  END AS validation_reason_code_label,
+  decision.validation_reason,
+  decision.blocking_digest,
+  decision.overlap_digest,
+  COALESCE(tag_summary.selected_tag_count, 0) AS selected_tag_count,
+  tag_summary.selected_tags
+FROM cleanup_root_decisions decision
+JOIN cleanup_runs run
+  ON run.cleanup_run_id = decision.cleanup_run_id
+ AND run.scan_id = decision.scan_id
+JOIN package_scans scan
+  ON scan.scan_id = run.scan_id
+JOIN manifests root_manifest
+  ON root_manifest.scan_id = decision.scan_id
+ AND root_manifest.digest = decision.digest
+LEFT JOIN selected_tag_summary tag_summary
+  ON tag_summary.cleanup_run_id = decision.cleanup_run_id
+ AND tag_summary.root_version_id = root_manifest.version_id;