vouchington-tooling 0.50.0 → 0.50.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vouchington-tooling",
-  "version": "0.50.0",
+  "version": "0.50.1",
   "description": "Vouchington CLI and extractable tooling libraries.",
   "homepage": "https://github.com/vouchington/vouchington-tooling/tree/main/packages/vouchington-tooling#readme",
   "bugs": {

package/scripts/gha/ghcr-main-history.sh

@@ -2,7 +2,17 @@
 # Sourced by ghcr-package-retention.sh for --main-history. Expects package_root, packages, apply,
 # keep_main and min_age_days from the caller.
 
+# shellcheck source=/dev/null
+. "$(dirname "${BASH_SOURCE[0]}")/ghcr-referenced-digests.sh"
+
 prune_main_history() {
+  # The registry namespace of the packages: GHCR_OWNER, else the workflow's repository owner.
+  local owner="${GHCR_OWNER:-${GITHUB_REPOSITORY_OWNER:-}}"
+  if [ -z "$owner" ]; then
+    echo '::error::ghcr-package-retention: GHCR_OWNER is required with --main-history' >&2
+    exit 2
+  fi
+
   # A zero keep count would delete every main image in one run.
   case "$keep_main" in
     '' | *[!0-9]*) keep_main=0 ;;
@@ -49,10 +59,13 @@ prune_main_history() {
       | min) as $oldest_image
     | ($versions | map(select(attachment and idle and $oldest_image != null
         and created < $oldest_image - 86400) | . + {reason: "orphan"})) as $orphans
-    | ($old_main + $unmerged + $orphans)[]
-    | "\(.id) \(tags | if length == 0 then "<untagged>" else join(",") end) \(.reason)"'
+    | {roots: ($versions | map(select((attachment | not) and (.id | IN($doomed[]) | not)) | .name)),
+       candidates: ($old_main + $unmerged + $orphans | map({id, name, reason,
+         tags: (tags | if length == 0 then "<untagged>" else join(",") end)}))}'
+  local filter='.candidates | map(select(.name | IN($referenced[]) | not))[]
+    | "\(.id) \(.tags) \(.reason)"'
 
-  local deleted_total=0 package path error deletions id tags reason
+  local deleted_total=0 package path error deletions id tags reason referenced image resolved
   for package in "${packages[@]}"; do
     path="$package_root/$package/versions"
     if ! error=$(gh api --paginate "$path?per_page=100" 2>&1 > "$work/pages"); then
@@ -67,8 +80,18 @@ prune_main_history() {
       exit 1
     fi
 
-    deletions=$(jq -r -s --rawfile revisions "$work/main-revisions" --argjson keep "$keep_main" \
-      --argjson cutoff "$cutoff" "$plan" "$work/pages")
+    jq -s --rawfile revisions "$work/main-revisions" --argjson keep "$keep_main" \
+      --argjson cutoff "$cutoff" "$plan" "$work/pages" > "$work/plan"
+    # Never delete a digest that a kept image or index still references (platform manifests,
+    # attestations, subjects). An unreadable kept manifest aborts rather than risk a delete.
+    referenced='[]'
+    if [ "$(jq '.candidates | length' "$work/plan")" -gt 0 ]; then
+      jq -r '.roots[]' "$work/plan" > "$work/roots"
+      image="$owner/$(printf '%b' "${package//%/\\x}")"
+      resolved=$(resolve_referenced "$image" "$owner" "$work" "$work/roots") || exit 1
+      referenced=$(printf '%s\n' "$resolved" | jq -R . | jq -s .)
+    fi
+    deletions=$(jq -r --argjson referenced "$referenced" "$filter" "$work/plan")
     echo "· $package: $(jq -s 'add // [] | length' "$work/pages") version(s)"
     while read -r id tags reason; do
       [ -n "$id" ] || continue

package/scripts/gha/ghcr-package-retention.sh

@@ -12,6 +12,10 @@
 # - An attachment: untagged or tagged only sha256-*. Attestations and their referrer indexes are
 #   pushed after their image, and platform manifests moments before it, so an attachment created
 #   over a day before the oldest surviving image, and idle for the same age, belongs to none.
+# Before deleting, the manifests of every surviving image are read from the registry (GH_TOKEN or
+# GITHUB_TOKEN, else gh auth token) and anything they reference through manifests[] or subject is
+# kept; if one cannot be read, the package is left untouched. The registry namespace is GHCR_OWNER,
+# else GITHUB_REPOSITORY_OWNER (required for user-owned packages too).
 # Packages that do not exist (HTTP 404) are skipped. Defaults to a dry run; pass --apply to delete.
 #
 # Packages come from the arguments, or from GHCR_PACKAGES (space separated) when none are given.

package/scripts/gha/ghcr-referenced-digests.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# Sourced by ghcr-main-history.sh. Walks OCI manifests through manifests[] and subject.
+
+# registry_token <image> <owner> <work-dir>: exchanges the GitHub token for a registry pull token
+# (GHCR's documented /token endpoint, Basic auth) and prints it. Credentials go to curl on stdin.
+registry_token() {
+  local image="$1" owner="$2" dir="$3" token registry
+  registry="${GHCR_REGISTRY_URL:-https://ghcr.io}"
+  token="${GH_TOKEN:-${GITHUB_TOKEN:-}}"
+  if [ -z "$token" ]; then
+    token=$(gh auth token) || {
+      echo '::error::No GH_TOKEN or GITHUB_TOKEN, and gh auth token failed' >&2
+      return 1
+    }
+  fi
+  if ! printf 'user = "%s:%s"\n' "$owner" "$token" |
+    curl -fsS -K - "$registry/token?scope=repository:$image:pull" \
+      > "$dir/token.json" 2> "$dir/curl-error"; then
+    printf '::error::Could not get a registry token for %s: %s\n' "$image" \
+      "$(cat "$dir/curl-error")" >&2
+    return 1
+  fi
+  jq -er '.token | select(type == "string" and . != "")' "$dir/token.json" || {
+    printf '::error::Registry token response for %s had no token\n' "$image" >&2
+    return 1
+  }
+}
+
+# resolve_referenced <image> <owner> <work-dir> <roots-file>: prints every digest reachable from
+# the root digests (one per line in the file), roots included. Returns non-zero on any failure, so
+# the caller deletes nothing.
+resolve_referenced() {
+  local image="$1" owner="$2" dir="$3" digest registry_bearer registry accept
+  registry="${GHCR_REGISTRY_URL:-https://ghcr.io}"
+  registry_bearer=$(registry_token "$image" "$owner" "$dir") || return 1
+  accept='application/vnd.oci.image.index.v1+json'
+  accept="$accept,application/vnd.oci.image.manifest.v1+json"
+  accept="$accept,application/vnd.docker.distribution.manifest.list.v2+json"
+  accept="$accept,application/vnd.docker.distribution.manifest.v2+json"
+
+  : > "$dir/seen"
+  cp "$4" "$dir/queue" || return 1
+  while [ -s "$dir/queue" ]; do
+    digest=$(head -n 1 "$dir/queue")
+    sed -i.bak 1d "$dir/queue" || return 1
+    rm -f "$dir/queue.bak"
+    [ -n "$digest" ] || continue
+    ! grep -qxF "$digest" "$dir/seen" || continue
+    echo "$digest" >> "$dir/seen"
+    if ! printf 'header = "Authorization: Bearer %s"\n' "$registry_bearer" |
+      curl -fsS -K - -H "Accept: $accept" "$registry/v2/$image/manifests/$digest" \
+        > "$dir/manifest" 2> "$dir/curl-error"; then
+      printf '::error::Could not read manifest %s of %s: %s\n' "$digest" "$image" \
+        "$(cat "$dir/curl-error")" >&2
+      return 1
+    fi
+    if ! jq -r '[(.manifests // [])[].digest, (.subject.digest // empty)] | .[]' \
+      "$dir/manifest" >> "$dir/queue" 2> "$dir/jq-error"; then
+      printf '::error::Could not parse manifest %s of %s: %s\n' "$digest" "$image" \
+        "$(cat "$dir/jq-error")" >&2
+      return 1
+    fi
+  done
+  cat "$dir/seen"
+}