Add temporary fixed-target retired chart package cleanup - #109
Merged
Merged
Conversation
Adds the owner-approved TEMPORARY manual-only workflow .github/workflows/delete-retired-sms-package.yml for the retired OCI chart package charts/opencode-sms-bridge at ghcr.io/makeitworkcloud/charts/opencode-sms-bridge (chart source removed in b7f85df). workflow_dispatch with no inputs; runs only on makeitworkcloud/charts@refs/heads/main; default GITHUB_TOKEN with contents:read and packages:write (this publishing repository holds admin on the package). The script resolves the package through the paginated org inventory, verifies id, name, package_type, and the exact repository association fail-closed before deleting the entire package (slashed container name URL-encoded for the API path), then confirms the result with a 404 GET plus an inventory relist. Absence after a successful inventory GET is success, so the run is idempotent on re-dispatch. actions/github-script is pinned to the verified v9.0.0 commit 3a2844b7e9c422d3c10d287c895573f7108da1b3 already used by helm.yml. No dispatch, merge, or package deletion happens in this commit; the helm publication workflow and its triggers are unchanged. Public packages over 5000 downloads are refused by GitHub and not bypassed; deleted packages remain restorable for 30 days. Remove this workflow after the confirmed cleanup run.
Adversarial review confirmed the structured Octokit REST methods encode
route parameters themselves: octokit/endpoint.js builds URLs through
its url-template util, whose encodeValue() applies encodeURIComponent
(encodeUnreserved) to simple {name} placeholders such as {package_name}
(source: octokit/endpoint.js src/util/url-template.ts). Passing a
pre-encoded name would double-encode the slash in
charts/opencode-sms-bridge as charts%252Fopencode-sms-bridge and the
calls would 404. Remove the encodedName variable and its incorrect
comment and pass the raw package name to the metadata GET, the version
list, the package DELETE, and the post-delete GET.
Add a pre-request self-check that fails before any API call unless
github.request.endpoint('GET /orgs/{org}/packages/{package_type}/{package_name}',
{...}) builds a URL whose pathname, read via new URL(), equals the
singly encoded /orgs/<owner>/packages/container/<encodeURIComponent(name)>
path. Only non-secret path names appear in the failure message; no
tokens are logged. The actions/github-script pin is unchanged.
No dispatch, merge, or live API execution happens in this commit.
Chart CI passedRepository hygiene and Helm validation passed. View the workflow run. |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Correct the temporary cleanup workflow after org-wide inventory returned HTTP400 before any deletion. Replace broad inventory with exact charts/opencode-sms-bridge metadata lookup, preserving all ownership and identity checks. Fixes: N/A — follows #109. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery ADVANCE. Raw-name/once-encoding verification retained. Any initial metadata error including404 fails rather than asserting absence. Exact positiveID/name/type/repository verification, targeted versions inventory, whole-package DELETE and bounded subsequentGET404 verification. No broad-token/PAT fallback, no request-header or raw error logging. ## Impact and rollout Same zero-input/manual-main/exact-repo guards, action pin, minimal token permissions and timeout/concurrency. No chart publication or other package deletion. Dispatch after successful reviewed merge under existing specific approval; remove temporary workflow after verified package absence. ## Safety and secrets - [x] No credentials, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Fixed deletion scope and retirement lifecycle preserved AI-assisted; no upstream communications.
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Replace unavailable SDK DELETE helper with documented whole-package REST request; require204. Previous run verified exact charts/opencode-sms-bridge metadata, producer association and5versions, then failed before issuing DELETE. Fixes: N/A — completes approved temporary cleanup #109/#110. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery ADVANCE. Only DELETE call/response assertion changes. No target, action-pin, credential, permission, encoding, metadata, trigger, timeout, concurrency, or post-delete verification changes. ## Impact and rollout Explicitly approved manual-main dispatch after checks/merge. Require204 then exactGET404; remove temporary workflow after success. No chart publication, new API authority or package scope expansion. ## Safety and secrets - [x] No secrets, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Exact destructive scope and disarm requirement retained AI-assisted; no upstream communications.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Owner explicitly approved creating/merging/running/removing this temporary workflow to delete only the organization container package charts/opencode-sms-bridge, associated with makeitworkcloud/charts. Whole-package deletion; no arbitrary inputs.
Fixes: N/A — final full-retirement cleanup.
Type of change
Validation
Adversarial/security/delivery reviews ADVANCE. Raw package name is passed to Octokit; pre-request URL assertion checks that nested slash is encoded exactly once. Paginated organization inventory and package metadata verify ID/name/container type/repository association before deleting. Verify GET404 and absent relisted package. Permission/download limits fail closed.
Impact and rollout
Manual workflow_dispatch only on main in this exact repository, no inputs, timeout/concurrency guards, pinned GitHub-maintained github-script, existing GITHUB_TOKEN with contents read/packages write. Does not publish charts or change other workflows. Removed chart has no remaining runtime consumer. After successful approved dispatch and absence verification, remove this workflow promptly. No PAT fallback or archive copies.
Canonical maintainer makeitworkcloud/charts. Existing toolset/workflows lack whole-package deletion; this is the explicitly approved temporary mechanism. GitHub retention/restore rules apply.
Safety and secrets
AI-assisted; explicit owner approval covers merge/dispatch/removal. No upstream communications.