Use exact metadata lookup for retired chart package deletion - #110
Merged
Merged
Conversation
Both dispatched runs failed at the first org-wide inventory GET with 400 Invalid argument before any deletion; the repository GITHUB_TOKEN is not authorized for org-wide package enumeration. Remove the inventory dependency entirely: the exact package-scoped endpoints remain the documented GITHUB_TOKEN path (the container registry grants the publishing repository's workflow token admin, which reads and writes package metadata and deletes the package). The script now starts with the exact getPackageForOrganization call using the raw package name charts/opencode-sms-bridge. Any error there, including 404, fails the run: 404 may mask a permission problem, so absence is never inferred. The id must be a positive safe integer, and name, package_type, and the exact repository association are verified fail-closed, with a missing association failing. Versions come from the exact versions endpoint; the whole package is deleted; and verification is bounded to at most five metadata GETs with a 1s wait on 200 (eventual consistency), 404 confirming the accepted 204 deletion. No relist is performed. 400 or 403 on any call fails without expanded access or PAT fallback. All API errors are reported through core.setFailed with status and message only; raw error objects, stack traces, and request headers are never logged. Guards are unchanged: manual workflow_dispatch with zero inputs, exact repository and refs/heads/main enforcement at the job and script level, five-minute timeout, fixed per-repo concurrency with cancel-in-progress false, the once-encoding pre-request URL check, and the pinned actions/github-script v9.0.0 commit. No dispatch, merge, or live API execution happens in this commit.
Chart CI passedRepository hygiene and Helm validation passed. View the workflow run. |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Replace unavailable SDK DELETE helper with documented whole-package REST request; require204. Previous run verified exact charts/opencode-sms-bridge metadata, producer association and5versions, then failed before issuing DELETE. Fixes: N/A — completes approved temporary cleanup #109/#110. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery ADVANCE. Only DELETE call/response assertion changes. No target, action-pin, credential, permission, encoding, metadata, trigger, timeout, concurrency, or post-delete verification changes. ## Impact and rollout Explicitly approved manual-main dispatch after checks/merge. Require204 then exactGET404; remove temporary workflow after success. No chart publication, new API authority or package scope expansion. ## Safety and secrets - [x] No secrets, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Exact destructive scope and disarm requirement retained AI-assisted; no upstream communications.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Correct the temporary cleanup workflow after org-wide inventory returned HTTP400 before any deletion. Replace broad inventory with exact charts/opencode-sms-bridge metadata lookup, preserving all ownership and identity checks.
Fixes: N/A — follows #109.
Type of change
Validation
Adversarial/security/delivery ADVANCE. Raw-name/once-encoding verification retained. Any initial metadata error including404 fails rather than asserting absence. Exact positiveID/name/type/repository verification, targeted versions inventory, whole-package DELETE and bounded subsequentGET404 verification. No broad-token/PAT fallback, no request-header or raw error logging.
Impact and rollout
Same zero-input/manual-main/exact-repo guards, action pin, minimal token permissions and timeout/concurrency. No chart publication or other package deletion. Dispatch after successful reviewed merge under existing specific approval; remove temporary workflow after verified package absence.
Safety and secrets
AI-assisted; no upstream communications.