Add temporary fixed-target retired image package cleanup - #52
Merged
Merged
Conversation
Adds the owner-approved TEMPORARY manual-only workflow .github/workflows/delete-retired-sms-package.yml for the retired container package opencode-sms-bridge (source removed in d833bb6). workflow_dispatch with no inputs; runs only on makeitworkcloud/images@refs/heads/main; default GITHUB_TOKEN with contents:read and packages:write (this publishing repository holds admin on the package). The script resolves the package through the paginated org inventory, verifies id, name, package_type, and the exact repository association fail-closed before deleting the entire package, then confirms the result with a 404 GET plus an inventory relist. Absence after a successful inventory GET is success, so the run is idempotent on re-dispatch. actions/github-script is pinned to the verified v9.0.0 commit 3a2844b7e9c422d3c10d287c895573f7108da1b3 already used by buildah.yml. No dispatch, merge, or package deletion happens in this commit; the buildah publication workflow and its triggers are unchanged. Public packages over 5000 downloads are refused by GitHub and not bypassed; deleted packages remain restorable for 30 days. Remove this workflow after the confirmed cleanup run.
Adversarial review confirmed the structured Octokit REST methods encode
route parameters themselves: octokit/endpoint.js builds URLs through
its url-template util, whose encodeValue() applies encodeURIComponent
(encodeUnreserved) to simple {name} placeholders such as {package_name}
(source: octokit/endpoint.js src/util/url-template.ts). Passing a
pre-encoded name would double-encode the slash (for example
charts%252F...). Remove the encodedName variable and its incorrect
comment and pass the raw package name to the metadata GET, the version
list, the package DELETE, and the post-delete GET.
Add a pre-request self-check that fails before any API call unless
github.request.endpoint('GET /orgs/{org}/packages/{package_type}/{package_name}',
{...}) builds a URL whose pathname, read via new URL(), equals the
singly encoded /orgs/<owner>/packages/container/<encodeURIComponent(name)>
path. Only non-secret path names appear in the failure message; no
tokens are logged. The actions/github-script pin is unchanged.
No dispatch, merge, or live API execution happens in this commit.
Image CI passedPre-commit validation passed. View the workflow run. |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Fix the approved temporary package-cleanup workflow after its first run failed on org-wide inventory HTTP400 before issuing any DELETE. Use the narrower exact-package metadata endpoint instead; fixed target and repository association checks remain mandatory. Fixes: N/A — follows #52. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery reviews ADVANCE. Initial metadata errors including404 fail closed; validate positive ID, exact name/type/producer repository before version inventory and whole-package DELETE. After accepted delete, at most5 GETs confirm404; other errors fail. Same pinned action, once-encoding check, permissions, repo/main guards, timeout, concurrency, zero inputs. No PAT fallback or raw error-header logging. ## Impact and rollout No deletion on PR/push. Owner-approved main dispatch still targets only opencode-sms-bridge. Previous failed run deleted nothing. After verified success, remove temporary workflow immediately. No other package/API privilege or repository setting change. ## Safety and secrets - [x] No credentials, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Fixed destructive scope and disarm requirement unchanged AI-assisted; no upstream communications.
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Replace unavailable Octokit deletePackageForOrganization helper with documented whole-package REST DELETE and require204. Previous approved run verified exact package/repository metadata and13versions, then failed before any DELETE. Fixes: N/A — completes approved temporary cleanup from #52/#53. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery reviewers ADVANCE. Only DELETE invocation changes; fixed target, action pin, permissions, zero-input manual-main guards, metadata validation, once-encoding check and bounded post-delete404 verification unchanged. ## Impact and rollout Owner-approved merge/dispatch targets only opencode-sms-bridge. Require metadata success, DELETE204, then GET404. No other API permissions or package targets. Delete temporary workflow immediately after verified success. No source/image publication involved. ## Safety and secrets - [x] No credentials, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Fixed scope and mandatory disarm preserved AI-assisted; no upstream communications.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Owner specifically approved creating, merging, manually running, and then removing this temporary cleanup workflow. Fixed target: organization container package opencode-sms-bridge associated with makeitworkcloud/images. Whole-package deletion, not just versions. No arbitrary input.
Fixes: N/A — final full-retirement cleanup.
Type of change
Validation
Adversarial/security/delivery reviews ADVANCE after raw Octokit package-name encoding correction. Runtime self-check verifies exact single encoding before API access. Org inventory, metadata identity/type/repository association and version inventory precede DELETE; GET404 plus relisted absence verify result. Current GITHUB_TOKEN package-admin access is tested at execution, not assumed as success.
Impact and rollout
Manual workflow_dispatch only, main/exact repository guards, zero inputs, fixed concurrency, five-minute timeout, pinned GitHub-maintained github-script; contents read/packages write only. No PR/push deletion, new PAT or external credentials. Source/runtime consumers already removed. After approved dispatch and verified deletion, remove this workflow in an immediate follow-up. GitHub package retention/restore/download-threshold rules still apply; failures stop without bypass.
Owner/maintainer: makeitworkcloud images. Existing workflows cannot delete packages; whole-package REST through existing publisher token is the approved narrow mechanism. Historical source does not republish package.
Safety and secrets
AI-assisted. Owner expressly authorized merge, dispatch and removal after verification. No upstream communications.