ghcr-manager 0.9.9 → 1.0.0

package/CHANGELOG.md

@@ -7,6 +7,42 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 
 ## [Unreleased]
 
+## [v1.0.0] - 2026-06-05
+
+`v1.0.0` is the first stable `v1.x` release of `ghcr-manager`.
+
+This milestone reflects the current project shape after repeated live testing, cleanup-planner tuning, visualizer
+refinement, and a full documentation pass.
+
+### Added
+
+- Added one merged graph-scenario SQLite database to the GitHub release assets as
+  `ghcr-manager-release-scenarios.sqlite`, so users can explore real before/after cleanup cases immediately in the
+  visualizer.
+- Added dedicated user docs for live test scenarios, package setup, and the workflow-to-visualizer path.
+
+### Changed
+
+- The release workflow now builds and attaches the merged scenario DB as part of the GitHub release publish flow.
+- Visualizer docs are now centered on one canonical `visualizer/README.md`, with richer screenshots and a release-asset
+  quick-demo path.
+- README and companion docs now explain the stable action/CLI/visualizer workflows more directly, including permission
+  guidance for dry-runs versus live cleanup and explicit Node.js 24 requirements for local npm installs.
+- Visualizer node labeling was clarified so manifest metadata is easier to interpret during graph inspection.
+
+## [0.9.10] - 2026-06-04
+
+### Changed
+
+- Cleanup planning for large package databases is much faster while preserving the existing cleanup behavior.
+- On a large validation package with more than 100k manifests, dry-run planning and summary generation dropped from more
+  than 20 minutes to roughly 15 seconds.
+
+### Fixed
+
+- Internal GHCR validation workflows now avoid GitHub's "cannot delete the last tagged version" failure mode during
+  temporary-tag cleanup.
+
 ## [0.9.9] - 2026-05-30
 
 No additional user-facing changes were introduced beyond `0.9.8`.

package/README.md

@@ -5,13 +5,19 @@
 [![Immutable Releases](https://img.shields.io/badge/releases-immutable-blue?labelColor=333)](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/immutable-releases)
 [![Tests](https://img.shields.io/github/actions/workflow/status/ghcr-manager/ghcr-manager/.github/workflows/ci_change-validation.yml?branch=main&label=test&style=flat-square)](https://github.com/ghcr-manager/ghcr-manager/actions/workflows/ci_change-validation.yml)
 
-Inspect, review, and manage GitHub Container Registry packages.
+Inspect, analyze, and manage large GitHub Container Registry packages.
 
 `ghcr-manager` is a GitHub Action for:
 
-- scanning one GHCR package into a SQLite database artifact
-- running cleanup with a GitHub step summary and optional DB artifact
-- previewing cleanup decisions with `dry-run` before making changes
+- scan GHCR packages: into SQLite database artifacts
+- cleanup packages: with a GitHub step summary and optional DB artifact
+- preview cleanup: with `dry-run` before making changes
+- visualize graphs: and their changes with the
+  [visualizer](https://github.com/ghcr-manager/ghcr-manager/blob/main/visualizer/README.md)
+
+![Example compare view: red-bordered manifests are present in the older scan and removed in the newer one.](https://raw.githubusercontent.com/ghcr-manager/ghcr-manager/main/docs/images/visualizer/graph-2images-cosign--wide.png "Example compare view: red-bordered manifests are present in the older scan and removed in the newer one.")
+
+_Example graph compare view: red-bordered manifests are present in the older scan and removed in the newer one._
 
 ## Quick Start
 
@@ -32,7 +38,7 @@ jobs:
 
       - name: Preview GHCR cleanup
         id: ghcr-manager
-        uses: ghcr-manager/ghcr-manager@0.9.9
+        uses: ghcr-manager/ghcr-manager@v1.0.0
         with:
           command: cleanup
           token: ${{ github.token }}
@@ -46,6 +52,12 @@ jobs:
           upload-artifacts: true
 ```
 
+> Permission notes:
+>
+> - `scan` and `cleanup` dry-runs need `packages: read`
+> - live `cleanup` that mutates GHCR needs `packages: write`
+> - artifact upload needs `actions: write`
+
 After the run:
 
 1. Open the GitHub step summary for the action run.
@@ -69,7 +81,7 @@ The action supports two commands:
 ### Preview cleanup
 
 ```yaml
-- uses: ghcr-manager/ghcr-manager@0.9.9
+- uses: ghcr-manager/ghcr-manager@v1.0.0
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -90,7 +102,7 @@ The action supports two commands:
 ### Apply cleanup
 
 ```yaml
-- uses: ghcr-manager/ghcr-manager@0.9.9
+- uses: ghcr-manager/ghcr-manager@v1.0.0
   with:
     command: cleanup
     token: ${{ github.token }}
@@ -106,10 +118,13 @@ If `scan-after-cleanup` is `true`, `cleanup` performs a second scan so the uploa
 
 Note: the second scan only runs if cleanup actually makes changes.
 
+Live cleanup permission note: change the workflow permission from `packages: read` to `packages: write` before turning
+off `dry-run`.
+
 ### Scan one package
 
 ```yaml
-- uses: ghcr-manager/ghcr-manager@0.9.9
+- uses: ghcr-manager/ghcr-manager@v1.0.0
   with:
     command: scan
     token: ${{ github.token }}
@@ -182,13 +197,46 @@ Current naming:
 
 ## Documentation Map
 
-- [GitHub Action usage](docs/action-usage.md): action commands, including `cleanup` and `scan`
-- [Visualizer](docs/visualizer.md): local graph inspection and scan-to-scan comparison
-- [Multi-package workflows](docs/db-merge-workflows.md): cleaning up multiple packages with one combined DB
-- [SQLite schema guide](docs/schema-description.md): practical explanation of the SQLite schema
-- [CLI usage](docs/cli-usage.md): companion CLI usage
+- [GitHub Action usage](https://github.com/ghcr-manager/ghcr-manager/blob/main/docs/action-usage.md): action commands,
+  including `cleanup` and `scan`
+- [Visualizer](https://github.com/ghcr-manager/ghcr-manager/blob/main/visualizer/README.md): local graph inspection and
+  scan-to-scan comparison
+- [Multi-package workflows](https://github.com/ghcr-manager/ghcr-manager/blob/main/docs/db-merge-workflows.md): cleaning
+  up multiple packages with one combined DB
+- [SQLite schema guide](https://github.com/ghcr-manager/ghcr-manager/blob/main/docs/schema-description.md): practical
+  explanation of the SQLite schema
+- [CLI usage](https://github.com/ghcr-manager/ghcr-manager/blob/main/docs/cli-usage.md): companion CLI usage
+
+## Explore A Real Scenario DB
+
+The release assets also include one merged SQLite DB from `ghcr-manager`'s live scenario workflows. You can use it as a
+quick visualizer demo and as a compact way to inspect dozens of real cleanup and graph cases.
+
+```sh
+curl -LO https://github.com/ghcr-manager/ghcr-manager/releases/latest/download/ghcr-manager-release-scenarios.sqlite
+npx ghcr-manager-visualizer --db ./ghcr-manager-release-scenarios.sqlite
+```
+
+For a first look in the visualizer, start with:
+
+- owner: `ghcr-manager-test`
+- package: select one with `2images` or `2multiarch` in the name
+- tag search: `image` or `multiarch`
+
+For more details, see
+[visualizer/README.md](https://github.com/ghcr-manager/ghcr-manager/blob/main/visualizer/README.md).
+
+## Project
+
+Main project and issue tracker:
+
+- Repository: <https://github.com/ghcr-manager/ghcr-manager>
+- Issues: <https://github.com/ghcr-manager/ghcr-manager/issues>
 
-## Acknowledgment
+## Similar Tools
 
-This project was influenced by [dataaxiom/ghcr-cleanup-action](https://github.com/dataaxiom/ghcr-cleanup-action), with a
-similar problem focus and a different implementation approach.
+- [ghcr-manager/ghcr-untag-action](https://github.com/ghcr-manager/ghcr-untag-action): focused tag removal without the
+  broader scan and cleanup workflow.
+- [dataaxiom/ghcr-cleanup-action](https://github.com/dataaxiom/ghcr-cleanup-action): another GHCR cleanup action with a
+  similar problem focus.
+- [mkoepf/ghcrctl](https://github.com/mkoepf/ghcrctl): CLI tooling for working with GHCR packages and graph deletions.

package/dist/db/planner/_planner-direct-target-roots-combined-sql.js

@@ -4,6 +4,7 @@ export function buildCombinedDirectTargetRootsQuery(scanId, options, selectedTag
     if (options.cutoffTimestamp) {
         baseParams.push(options.cutoffTimestamp);
     }
+    baseParams.push(scanId, scanId);
     const taggedBranchEnabled = options.deleteTagsRequested || options.keepNTagged !== undefined ? 1 : 0;
     const deleteTagsRequested = options.deleteTagsRequested ? 1 : 0;
     const deleteOrphanedImages = options.deleteOrphanedImages ? 1 : 0;
@@ -41,35 +42,31 @@ export function buildCombinedDirectTargetRootsQuery(scanId, options, selectedTag
       WHERE m.scan_id = ?
         ${cutoffSql}
     ),
-    tag_counts AS (
-      SELECT
-        t.version_id,
-        COUNT(t.tag) AS tag_count
-      FROM tags t
-      WHERE t.scan_id = ?
-        AND t.is_digest_tag = 0
-      GROUP BY t.version_id
-    ),
-    parented_digests AS (
-      SELECT DISTINCT me.child_digest
-      FROM manifest_edges me
-      WHERE me.scan_id = ?
-        AND me.edge_kind != 'digest-tag-referrer'
-    ),
     root_candidates AS (
       SELECT
         bm.version_id,
         bm.root_digest,
         bm.root_manifest_kind,
         bm.created_at,
-        COALESCE(tc.tag_count, 0) AS tag_count,
-        CASE WHEN COALESCE(tc.tag_count, 0) > 0 THEN 1 ELSE 0 END AS is_tagged,
-        CASE WHEN pd.child_digest IS NULL THEN 0 ELSE 1 END AS has_ancestor
+        (
+          SELECT COUNT(*)
+          FROM tags t
+          WHERE t.scan_id = ?
+            AND t.version_id = bm.version_id
+            AND t.is_digest_tag = 0
+        ) AS tag_count,
+        CASE
+          WHEN EXISTS (
+            SELECT 1
+            FROM manifest_edges me
+            WHERE me.scan_id = ?
+              AND me.child_digest = bm.root_digest
+              AND me.edge_kind != 'digest-tag-referrer'
+          )
+            THEN 1
+          ELSE 0
+        END AS has_ancestor
       FROM base_manifests bm
-      LEFT JOIN tag_counts tc
-        ON tc.version_id = bm.version_id
-      LEFT JOIN parented_digests pd
-        ON pd.child_digest = bm.root_digest
     ),
     selected_tags AS (
       ${selectedTagsSql}
@@ -102,7 +99,7 @@ export function buildCombinedDirectTargetRootsQuery(scanId, options, selectedTag
       LEFT JOIN excluded_versions ev
         ON ev.version_id = rc.version_id
       WHERE (
-          rc.is_tagged = 1
+          rc.tag_count > 0
           OR (? = 1 AND COALESCE(mtc.matched_tag_count, 0) > 0)
         )
         AND ev.version_id IS NULL
@@ -156,7 +153,7 @@ export function buildCombinedDirectTargetRootsQuery(scanId, options, selectedTag
           ORDER BY rc.created_at DESC, rc.version_id DESC, rc.root_digest DESC
         ) AS recency_rank
       FROM root_candidates rc
-      WHERE rc.is_tagged = 0
+      WHERE rc.tag_count = 0
         AND rc.has_ancestor = 0
         AND (? = 1 OR ? = 1)
     ),

package/dist/db/planner/_planner-direct-target-roots-combined.js

@@ -5,6 +5,6 @@ export function listCombinedDirectTargetRoots(sql, scanId, options) {
     const { selectedTagsSql, selectedParams, excludedVersionsSql, excludedParams } = buildDirectTargetRootTagFilters(sql, scanId, options);
     const { query, baseParams, tailParams } = buildCombinedDirectTargetRootsQuery(scanId, options, selectedTagsSql, excludedVersionsSql);
     return sql
-        .all(query, [...baseParams, scanId, scanId, ...selectedParams, ...excludedParams, ...tailParams])
+        .all(query, [...baseParams, ...selectedParams, ...excludedParams, ...tailParams])
         .map(mapPlanRootRow);
 }

package/dist/db/planner/_planner-plan-artifacts-blocked-roots-sql.d.ts

@@ -1 +1 @@
-export declare const _LIST_BLOCKED_ROOTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT\n      m.version_id AS tagged_version_id,\n      m.digest AS tagged_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  ranked_blocks AS (\n    SELECT\n      dtr.root_version_id AS blocked_version_id,\n      dtr.root_digest AS blocked_digest,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      dtr.root_digest AS overlap_digest,\n      dtr.root_manifest_kind AS overlap_manifest_kind,\n      'overlap-with-retained-root' AS block_reason,\n      ROW_NUMBER() OVER (\n        PARTITION BY dtr.root_digest, retained.tagged_digest\n        ORDER BY\n          retained_overlap.min_distance,\n          dtr.root_digest\n      ) AS rn\n    FROM temp_direct_target_roots dtr\n    JOIN retained_tagged_manifests retained\n      ON retained.tagged_digest <> dtr.root_digest\n    JOIN manifest_reachability retained_overlap\n      ON retained_overlap.scan_id = ?\n     AND retained_overlap.ancestor_digest = retained.tagged_digest\n     AND retained_overlap.descendant_digest = dtr.root_digest\n  )\n  SELECT\n    blocked_version_id,\n    blocked_digest,\n    blocking_version_id,\n    blocking_digest,\n    overlap_digest,\n    overlap_manifest_kind,\n    block_reason\n  FROM ranked_blocks\n  WHERE rn = 1\n  ORDER BY blocked_digest, blocking_digest, overlap_digest\n";
+export declare const _LIST_BLOCKED_ROOTS_SQL = "\n  WITH selected_root_graphs AS (\n    SELECT\n      dtr.root_version_id,\n      dtr.root_digest,\n      dtr.root_manifest_kind,\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  selected_graphs AS (\n    SELECT DISTINCT\n      selected_root_graphs.graph_id\n    FROM selected_root_graphs\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id,\n      m.version_id AS tagged_version_id,\n      m.digest AS tagged_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  ranked_blocks AS (\n    SELECT\n      root_graph.root_version_id AS blocked_version_id,\n      root_graph.root_digest AS blocked_digest,\n      retained.tagged_version_id AS blocking_version_id,\n      retained.tagged_digest AS blocking_digest,\n      root_graph.root_digest AS overlap_digest,\n      root_graph.root_manifest_kind AS overlap_manifest_kind,\n      'overlap-with-retained-root' AS block_reason,\n      ROW_NUMBER() OVER (\n        PARTITION BY root_graph.root_digest, retained.tagged_digest\n        ORDER BY\n          retained_overlap.min_distance,\n          root_graph.root_digest\n      ) AS rn\n    FROM selected_root_graphs root_graph\n    JOIN retained_tagged_manifests retained\n      ON retained.graph_id = root_graph.graph_id\n     AND retained.tagged_digest <> root_graph.root_digest\n    JOIN manifest_reachability retained_overlap\n      ON retained_overlap.scan_id = ?\n     AND retained_overlap.ancestor_digest = retained.tagged_digest\n     AND retained_overlap.descendant_digest = root_graph.root_digest\n  )\n  SELECT\n    blocked_version_id,\n    blocked_digest,\n    blocking_version_id,\n    blocking_digest,\n    overlap_digest,\n    overlap_manifest_kind,\n    block_reason\n  FROM ranked_blocks\n  WHERE rn = 1\n  ORDER BY blocked_digest, blocking_digest, overlap_digest\n";

package/dist/db/planner/_planner-plan-artifacts-blocked-roots-sql.js

@@ -1,14 +1,23 @@
 export const _LIST_BLOCKED_ROOTS_SQL = `
-  WITH selected_graphs AS (
-    SELECT DISTINCT
+  WITH selected_root_graphs AS (
+    SELECT
+      dtr.root_version_id,
+      dtr.root_digest,
+      dtr.root_manifest_kind,
       manifest_graphs.graph_id
     FROM temp_direct_target_roots dtr
     CROSS JOIN manifest_graphs
     WHERE manifest_graphs.scan_id = ?
       AND manifest_graphs.digest = dtr.root_digest
   ),
+  selected_graphs AS (
+    SELECT DISTINCT
+      selected_root_graphs.graph_id
+    FROM selected_root_graphs
+  ),
   retained_tagged_manifests AS (
-    SELECT
+    SELECT DISTINCT
+      manifest_graphs.graph_id,
       m.version_id AS tagged_version_id,
       m.digest AS tagged_digest
     FROM selected_graphs
@@ -30,26 +39,27 @@ export const _LIST_BLOCKED_ROOTS_SQL = `
   ),
   ranked_blocks AS (
     SELECT
-      dtr.root_version_id AS blocked_version_id,
-      dtr.root_digest AS blocked_digest,
+      root_graph.root_version_id AS blocked_version_id,
+      root_graph.root_digest AS blocked_digest,
       retained.tagged_version_id AS blocking_version_id,
       retained.tagged_digest AS blocking_digest,
-      dtr.root_digest AS overlap_digest,
-      dtr.root_manifest_kind AS overlap_manifest_kind,
+      root_graph.root_digest AS overlap_digest,
+      root_graph.root_manifest_kind AS overlap_manifest_kind,
       'overlap-with-retained-root' AS block_reason,
       ROW_NUMBER() OVER (
-        PARTITION BY dtr.root_digest, retained.tagged_digest
+        PARTITION BY root_graph.root_digest, retained.tagged_digest
         ORDER BY
           retained_overlap.min_distance,
-          dtr.root_digest
+          root_graph.root_digest
       ) AS rn
-    FROM temp_direct_target_roots dtr
+    FROM selected_root_graphs root_graph
     JOIN retained_tagged_manifests retained
-      ON retained.tagged_digest <> dtr.root_digest
+      ON retained.graph_id = root_graph.graph_id
+     AND retained.tagged_digest <> root_graph.root_digest
     JOIN manifest_reachability retained_overlap
       ON retained_overlap.scan_id = ?
      AND retained_overlap.ancestor_digest = retained.tagged_digest
-     AND retained_overlap.descendant_digest = dtr.root_digest
+     AND retained_overlap.descendant_digest = root_graph.root_digest
   )
   SELECT
     blocked_version_id,

package/dist/db/planner/_planner-plan-artifacts-closure-sql.d.ts

@@ -1 +1 @@
-export declare const _LIST_CLOSURE_MANIFESTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      m.version_id,\n      m.digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  retained_manifests AS (\n    SELECT\n      retained.version_id,\n      retained.digest\n    FROM retained_tagged_manifests retained\n\n    UNION\n\n    SELECT\n      m.version_id,\n      m.digest\n    FROM retained_tagged_manifests retained\n    CROSS JOIN manifest_reachability mr\n    CROSS JOIN manifests m\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = retained.digest\n      AND mr.min_distance > 0\n      AND m.scan_id = ?\n      AND m.digest = mr.descendant_digest\n  ),\n  direct_target_closure AS (\n    SELECT\n      dtr.root_version_id AS source_version_id,\n      dtr.root_digest AS source_digest,\n      dtr.root_version_id AS member_version_id,\n      dtr.root_digest AS member_digest,\n      dtr.root_manifest_kind AS member_manifest_kind,\n      0 AS hops_from_root\n    FROM temp_direct_target_roots dtr\n\n    UNION ALL\n\n    SELECT\n      dtr.root_version_id AS source_version_id,\n      dtr.root_digest AS source_digest,\n      m.version_id AS member_version_id,\n      m.digest AS member_digest,\n      m.manifest_kind AS member_manifest_kind,\n      mr.min_distance AS hops_from_root\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_reachability mr\n    CROSS JOIN manifests m\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = dtr.root_digest\n      AND mr.min_distance > 0\n      AND m.scan_id = ?\n      AND m.digest = mr.descendant_digest\n  ),\n  closure_seed AS (\n    SELECT\n      dtc.source_version_id,\n      dtc.source_digest,\n      dtc.member_digest,\n      dtc.hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root = 0\n       OR NOT EXISTS (\n         SELECT 1\n         FROM retained_manifests retained\n         WHERE retained.digest = dtc.member_digest\n       )\n  ),\n  undirected_edges AS (\n    SELECT\n      me.parent_digest AS source_digest,\n      me.child_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs parent_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_parent\n    WHERE parent_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = parent_graph.graph_id\n      AND parent_graph.digest = me.parent_digest\n      AND me.scan_id = ?\n\n    UNION\n\n    SELECT\n      me.child_digest AS source_digest,\n      me.parent_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs child_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_child\n    WHERE child_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = child_graph.graph_id\n      AND child_graph.digest = me.child_digest\n      AND me.scan_id = ?\n  ),\n  delete_component_members AS (\n    SELECT\n      seed.source_version_id,\n      seed.source_digest,\n      seed.member_digest\n    FROM closure_seed seed\n\n    UNION\n\n    SELECT\n      walk.source_version_id,\n      walk.source_digest,\n      m.digest AS member_digest\n    FROM delete_component_members walk\n    JOIN undirected_edges edge\n      ON edge.source_digest = walk.member_digest\n    JOIN manifests m\n      ON m.scan_id = ?\n     AND m.digest = edge.target_digest\n    WHERE NOT EXISTS (\n        SELECT 1\n        FROM retained_manifests retained\n        WHERE retained.digest = m.digest\n      )\n  ),\n  source_seed_hops AS (\n    SELECT\n      seed.source_digest,\n      MAX(seed.hops_from_root) AS max_seed_hops\n    FROM closure_seed seed\n    GROUP BY seed.source_digest\n  ),\n  descendant_hops AS (\n    SELECT\n      dtc.source_digest,\n      dtc.member_digest,\n      MIN(dtc.hops_from_root) AS min_hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root > 0\n    GROUP BY dtc.source_digest, dtc.member_digest\n  )\n  SELECT\n    walk.source_version_id,\n    walk.source_digest,\n    MIN(member_manifest.version_id) AS member_version_id,\n    walk.member_digest,\n    MIN(member_manifest.manifest_kind) AS member_manifest_kind,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 0\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN descendant_hops.min_hops_from_root\n      ELSE source_seed_hops.max_seed_hops + 1\n    END AS hops_from_root,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 'root'\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN 'descendant'\n      ELSE 'connected'\n    END AS member_role\n  FROM delete_component_members walk\n  JOIN manifests member_manifest\n    ON member_manifest.scan_id = ?\n   AND member_manifest.digest = walk.member_digest\n  JOIN source_seed_hops\n    ON source_seed_hops.source_digest = walk.source_digest\n  LEFT JOIN descendant_hops\n    ON descendant_hops.source_digest = walk.source_digest\n   AND descendant_hops.member_digest = walk.member_digest\n  GROUP BY\n    walk.source_version_id,\n    walk.source_digest,\n    walk.member_digest,\n    descendant_hops.min_hops_from_root,\n    source_seed_hops.max_seed_hops\n  ORDER BY walk.source_digest, hops_from_root, walk.member_digest\n";
+export declare const _LIST_CLOSURE_MANIFESTS_SQL = "\n  WITH selected_graphs AS (\n    SELECT DISTINCT\n      manifest_graphs.graph_id\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_graphs\n    WHERE manifest_graphs.scan_id = ?\n      AND manifest_graphs.digest = dtr.root_digest\n  ),\n  retained_tagged_manifests AS (\n    SELECT DISTINCT\n      m.digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs\n    CROSS JOIN manifests m\n    JOIN tags t\n      ON t.scan_id = m.scan_id\n     AND t.version_id = m.version_id\n     AND t.is_digest_tag = 0\n    WHERE manifest_graphs.scan_id = m.scan_id\n      AND selected_graphs.graph_id = manifest_graphs.graph_id\n      AND manifest_graphs.digest = m.digest\n      AND m.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM temp_direct_target_roots dtr\n        WHERE dtr.root_digest = m.digest\n      )\n  ),\n  retained_manifests AS (\n    SELECT\n      retained.digest\n    FROM retained_tagged_manifests retained\n\n    UNION\n\n    SELECT\n      mr.descendant_digest AS digest\n    FROM retained_tagged_manifests retained\n    CROSS JOIN manifest_reachability mr\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = retained.digest\n      AND mr.min_distance > 0\n  ),\n  direct_target_closure AS (\n    SELECT\n      dtr.root_digest AS source_digest,\n      dtr.root_digest AS member_digest,\n      0 AS hops_from_root\n    FROM temp_direct_target_roots dtr\n\n    UNION ALL\n\n    SELECT\n      dtr.root_digest AS source_digest,\n      mr.descendant_digest AS member_digest,\n      mr.min_distance AS hops_from_root\n    FROM temp_direct_target_roots dtr\n    CROSS JOIN manifest_reachability mr\n    WHERE mr.scan_id = ?\n      AND mr.ancestor_digest = dtr.root_digest\n      AND mr.min_distance > 0\n  ),\n  closure_seed AS (\n    SELECT\n      dtc.source_digest,\n      dtc.member_digest,\n      dtc.hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root = 0\n       OR NOT EXISTS (\n         SELECT 1\n         FROM retained_manifests retained\n         WHERE retained.digest = dtc.member_digest\n       )\n  ),\n  undirected_edges AS (\n    SELECT\n      me.parent_digest AS source_digest,\n      me.child_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs parent_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_parent\n    WHERE parent_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = parent_graph.graph_id\n      AND parent_graph.digest = me.parent_digest\n      AND me.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM retained_manifests retained\n        WHERE retained.digest = me.parent_digest\n           OR retained.digest = me.child_digest\n      )\n\n    UNION\n\n    SELECT\n      me.child_digest AS source_digest,\n      me.parent_digest AS target_digest\n    FROM selected_graphs\n    CROSS JOIN manifest_graphs child_graph\n    CROSS JOIN manifest_edges me INDEXED BY idx_manifest_edges_scan_child\n    WHERE child_graph.scan_id = me.scan_id\n      AND selected_graphs.graph_id = child_graph.graph_id\n      AND child_graph.digest = me.child_digest\n      AND me.scan_id = ?\n      AND NOT EXISTS (\n        SELECT 1\n        FROM retained_manifests retained\n        WHERE retained.digest = me.parent_digest\n           OR retained.digest = me.child_digest\n      )\n  ),\n  delete_component_members AS (\n    SELECT\n      seed.source_digest,\n      seed.member_digest\n    FROM closure_seed seed\n\n    UNION\n\n    SELECT\n      walk.source_digest,\n      edge.target_digest AS member_digest\n    FROM delete_component_members walk\n    JOIN undirected_edges edge\n      ON edge.source_digest = walk.member_digest\n    WHERE NOT EXISTS (\n        SELECT 1\n        FROM retained_manifests retained\n        WHERE retained.digest = edge.target_digest\n      )\n  ),\n  source_seed_hops AS (\n    SELECT\n      seed.source_digest,\n      MAX(seed.hops_from_root) AS max_seed_hops\n    FROM closure_seed seed\n    GROUP BY seed.source_digest\n  ),\n  descendant_hops AS (\n    SELECT\n      dtc.source_digest,\n      dtc.member_digest,\n      MIN(dtc.hops_from_root) AS min_hops_from_root\n    FROM direct_target_closure dtc\n    WHERE dtc.hops_from_root > 0\n    GROUP BY dtc.source_digest, dtc.member_digest\n  )\n  SELECT\n    dtr.root_version_id AS source_version_id,\n    walk.source_digest,\n    MIN(member_manifest.version_id) AS member_version_id,\n    walk.member_digest,\n    MIN(member_manifest.manifest_kind) AS member_manifest_kind,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 0\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN descendant_hops.min_hops_from_root\n      ELSE source_seed_hops.max_seed_hops + 1\n    END AS hops_from_root,\n    CASE\n      WHEN walk.member_digest = walk.source_digest\n        THEN 'root'\n      WHEN descendant_hops.min_hops_from_root IS NOT NULL\n        THEN 'descendant'\n      ELSE 'connected'\n    END AS member_role\n  FROM delete_component_members walk\n  JOIN temp_direct_target_roots dtr\n    ON dtr.root_digest = walk.source_digest\n  JOIN manifests member_manifest\n    ON member_manifest.scan_id = ?\n   AND member_manifest.digest = walk.member_digest\n  JOIN source_seed_hops\n    ON source_seed_hops.source_digest = walk.source_digest\n  LEFT JOIN descendant_hops\n    ON descendant_hops.source_digest = walk.source_digest\n   AND descendant_hops.member_digest = walk.member_digest\n  GROUP BY\n    dtr.root_version_id,\n    walk.source_digest,\n    walk.member_digest,\n    descendant_hops.min_hops_from_root,\n    source_seed_hops.max_seed_hops\n  ORDER BY walk.source_digest, hops_from_root, walk.member_digest\n";

package/dist/db/planner/_planner-plan-artifacts-closure-sql.js

@@ -9,7 +9,6 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
   ),
   retained_tagged_manifests AS (
     SELECT DISTINCT
-      m.version_id,
       m.digest
     FROM selected_graphs
     CROSS JOIN manifest_graphs
@@ -30,55 +29,40 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
   ),
   retained_manifests AS (
     SELECT
-      retained.version_id,
       retained.digest
     FROM retained_tagged_manifests retained
 
     UNION
 
     SELECT
-      m.version_id,
-      m.digest
+      mr.descendant_digest AS digest
     FROM retained_tagged_manifests retained
     CROSS JOIN manifest_reachability mr
-    CROSS JOIN manifests m
     WHERE mr.scan_id = ?
       AND mr.ancestor_digest = retained.digest
       AND mr.min_distance > 0
-      AND m.scan_id = ?
-      AND m.digest = mr.descendant_digest
   ),
   direct_target_closure AS (
     SELECT
-      dtr.root_version_id AS source_version_id,
       dtr.root_digest AS source_digest,
-      dtr.root_version_id AS member_version_id,
       dtr.root_digest AS member_digest,
-      dtr.root_manifest_kind AS member_manifest_kind,
       0 AS hops_from_root
     FROM temp_direct_target_roots dtr
 
     UNION ALL
 
     SELECT
-      dtr.root_version_id AS source_version_id,
       dtr.root_digest AS source_digest,
-      m.version_id AS member_version_id,
-      m.digest AS member_digest,
-      m.manifest_kind AS member_manifest_kind,
+      mr.descendant_digest AS member_digest,
       mr.min_distance AS hops_from_root
     FROM temp_direct_target_roots dtr
     CROSS JOIN manifest_reachability mr
-    CROSS JOIN manifests m
     WHERE mr.scan_id = ?
       AND mr.ancestor_digest = dtr.root_digest
       AND mr.min_distance > 0
-      AND m.scan_id = ?
-      AND m.digest = mr.descendant_digest
   ),
   closure_seed AS (
     SELECT
-      dtc.source_version_id,
       dtc.source_digest,
       dtc.member_digest,
       dtc.hops_from_root
@@ -101,6 +85,12 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
       AND selected_graphs.graph_id = parent_graph.graph_id
       AND parent_graph.digest = me.parent_digest
       AND me.scan_id = ?
+      AND NOT EXISTS (
+        SELECT 1
+        FROM retained_manifests retained
+        WHERE retained.digest = me.parent_digest
+           OR retained.digest = me.child_digest
+      )
 
     UNION
 
@@ -114,10 +104,15 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
       AND selected_graphs.graph_id = child_graph.graph_id
       AND child_graph.digest = me.child_digest
       AND me.scan_id = ?
+      AND NOT EXISTS (
+        SELECT 1
+        FROM retained_manifests retained
+        WHERE retained.digest = me.parent_digest
+           OR retained.digest = me.child_digest
+      )
   ),
   delete_component_members AS (
     SELECT
-      seed.source_version_id,
       seed.source_digest,
       seed.member_digest
     FROM closure_seed seed
@@ -125,19 +120,15 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
     UNION
 
     SELECT
-      walk.source_version_id,
       walk.source_digest,
-      m.digest AS member_digest
+      edge.target_digest AS member_digest
     FROM delete_component_members walk
     JOIN undirected_edges edge
       ON edge.source_digest = walk.member_digest
-    JOIN manifests m
-      ON m.scan_id = ?
-     AND m.digest = edge.target_digest
     WHERE NOT EXISTS (
         SELECT 1
         FROM retained_manifests retained
-        WHERE retained.digest = m.digest
+        WHERE retained.digest = edge.target_digest
       )
   ),
   source_seed_hops AS (
@@ -157,7 +148,7 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
     GROUP BY dtc.source_digest, dtc.member_digest
   )
   SELECT
-    walk.source_version_id,
+    dtr.root_version_id AS source_version_id,
     walk.source_digest,
     MIN(member_manifest.version_id) AS member_version_id,
     walk.member_digest,
@@ -177,6 +168,8 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
       ELSE 'connected'
     END AS member_role
   FROM delete_component_members walk
+  JOIN temp_direct_target_roots dtr
+    ON dtr.root_digest = walk.source_digest
   JOIN manifests member_manifest
     ON member_manifest.scan_id = ?
    AND member_manifest.digest = walk.member_digest
@@ -186,7 +179,7 @@ export const _LIST_CLOSURE_MANIFESTS_SQL = `
     ON descendant_hops.source_digest = walk.source_digest
    AND descendant_hops.member_digest = walk.member_digest
   GROUP BY
-    walk.source_version_id,
+    dtr.root_version_id,
     walk.source_digest,
     walk.member_digest,
     descendant_hops.min_hops_from_root,

package/dist/db/planner/_planner-plan-artifacts.js

@@ -47,7 +47,7 @@ export class PlannerPlanArtifacts {
     }
     #listClosureManifests(scanId) {
         return this.#sql
-            .all(_LIST_CLOSURE_MANIFESTS_SQL, [scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId, scanId])
+            .all(_LIST_CLOSURE_MANIFESTS_SQL, [scanId, scanId, scanId, scanId, scanId, scanId, scanId])
             .map(mapClosureManifestRow);
     }
     #listBlockedRoots(scanId) {

package/package.json

@@ -9,7 +9,8 @@
     "type": "git",
     "url": "https://github.com/ghcr-manager/ghcr-manager"
   },
-  "version": "0.9.9",
+  "license": "MIT",
+  "version": "v1.0.0",
   "type": "module",
   "workspaces": [
     "visualizer"

package/resources/sql/schema/001_schema.sql

@@ -204,10 +204,16 @@ CREATE INDEX IF NOT EXISTS idx_cleanup_runs_scan_id ON cleanup_runs(scan_id);
 CREATE INDEX IF NOT EXISTS idx_cleanup_protected_root_blocks_run_blocked
   ON cleanup_protected_root_blocks(cleanup_run_id, blocked_digest);
 CREATE INDEX IF NOT EXISTS idx_tags_scan_version ON tags(scan_id, version_id);
+CREATE INDEX IF NOT EXISTS idx_tags_scan_version_nondigest
+  ON tags(scan_id, version_id)
+  WHERE is_digest_tag = 0;
 CREATE INDEX IF NOT EXISTS idx_manifest_descriptors_scan_child ON manifest_descriptors(scan_id, child_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_parent ON manifest_edges(scan_id, parent_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_child ON manifest_edges(scan_id, child_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_child_kind ON manifest_edges(scan_id, child_digest, edge_kind);
+CREATE INDEX IF NOT EXISTS idx_manifest_edges_scan_child_nondigest_referrer
+  ON manifest_edges(scan_id, child_digest)
+  WHERE edge_kind != 'digest-tag-referrer';
 CREATE INDEX IF NOT EXISTS idx_manifest_reachability_scan_descendant
   ON manifest_reachability(scan_id, descendant_digest);
 CREATE INDEX IF NOT EXISTS idx_manifest_reachability_scan_descendant_distance