Use exact metadata lookup for retired package deletion - #53
Merged
Merged
Conversation
Both dispatched runs failed at the first org-wide inventory GET with 400 Invalid argument before any deletion; the repository GITHUB_TOKEN is not authorized for org-wide package enumeration. Remove the inventory dependency entirely: the exact package-scoped endpoints remain the documented GITHUB_TOKEN path (the container registry grants the publishing repository's workflow token admin, which reads and writes package metadata and deletes the package). The script now starts with the exact getPackageForOrganization call using the raw package name. Any error there, including 404, fails the run: 404 may mask a permission problem, so absence is never inferred. The id must be a positive safe integer, and name, package_type, and the exact repository association are verified fail-closed, with a missing association failing. Versions come from the exact versions endpoint; the whole package is deleted; and verification is bounded to at most five metadata GETs with a 1s wait on 200 (eventual consistency), 404 confirming the accepted 204 deletion. No relist is performed. 400 or 403 on any call fails without expanded access or PAT fallback. All API errors are reported through core.setFailed with status and message only; raw error objects, stack traces, and request headers are never logged. Guards are unchanged: manual workflow_dispatch with zero inputs, exact repository and refs/heads/main enforcement at the job and script level, five-minute timeout, fixed per-repo concurrency with cancel-in-progress false, the once-encoding pre-request URL check, and the pinned actions/github-script v9.0.0 commit. No dispatch, merge, or live API execution happens in this commit.
Image CI passedPre-commit validation passed. View the workflow run. |
7 tasks
xnoto
added a commit
that referenced
this pull request
Sep 20, 2026
## Summary Replace unavailable Octokit deletePackageForOrganization helper with documented whole-package REST DELETE and require204. Previous approved run verified exact package/repository metadata and13versions, then failed before any DELETE. Fixes: N/A — completes approved temporary cleanup from #52/#53. ## Type of change - [x] Bug fix - [x] CI / reusable workflow ## Validation - [ ] Required PR checks pass — pending. - [x] No generated files hand-edited. Adversarial/security/delivery reviewers ADVANCE. Only DELETE invocation changes; fixed target, action pin, permissions, zero-input manual-main guards, metadata validation, once-encoding check and bounded post-delete404 verification unchanged. ## Impact and rollout Owner-approved merge/dispatch targets only opencode-sms-bridge. Require metadata success, DELETE204, then GET404. No other API permissions or package targets. Delete temporary workflow immediately after verified success. No source/image publication involved. ## Safety and secrets - [x] No credentials, state, or sensitive plans - [x] No local OpenTofu/state operations - [x] Fixed scope and mandatory disarm preserved AI-assisted; no upstream communications.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fix the approved temporary package-cleanup workflow after its first run failed on org-wide inventory HTTP400 before issuing any DELETE. Use the narrower exact-package metadata endpoint instead; fixed target and repository association checks remain mandatory.
Fixes: N/A — follows #52.
Type of change
Validation
Adversarial/security/delivery reviews ADVANCE. Initial metadata errors including404 fail closed; validate positive ID, exact name/type/producer repository before version inventory and whole-package DELETE. After accepted delete, at most5 GETs confirm404; other errors fail. Same pinned action, once-encoding check, permissions, repo/main guards, timeout, concurrency, zero inputs. No PAT fallback or raw error-header logging.
Impact and rollout
No deletion on PR/push. Owner-approved main dispatch still targets only opencode-sms-bridge. Previous failed run deleted nothing. After verified success, remove temporary workflow immediately. No other package/API privilege or repository setting change.
Safety and secrets
AI-assisted; no upstream communications.