From 6990483139379b9115b5a1f9a509a9acc8b17d51 Mon Sep 17 00:00:00 2001
From: Steven Welch <steven@makeitwork.cloud>
Date: Sun, 20 Sep 2026 00:00:03 -0600
Subject: [PATCH] ci: delete via documented REST request instead of missing SDK
 helper

The dispatched run 35492786770 verified the target (metadata
id=14842106, repository association makeitworkcloud/images, 13
versions) but failed before any HTTP DELETE because the pinned
github-script runtime exposes no
github.rest.packages.deletePackageForOrganization helper ("is not a
function"). No alias is guessed: replace only that call with
github.request('DELETE /orgs/{org}/packages/{package_type}/{package_name}',
{org, package_type, package_name}) using raw parameters. github.request
is the same stable pinned-runtime API already exercised in this script
through github.request.endpoint, and the step 0 pre-request check
already verified this exact route template encodes the parameters
exactly once. The official REST packages reference documents this
route and its 204 No Content success response.

Capture the response and require status 204 before logging the
deletion as accepted and starting the post-delete verification loop;
any other status fails. All identity checks, exact repository and
refs/heads/main guards, zero-input manual dispatch, permissions, pin,
timeout, concurrency, error handling, and bounded verification are
unchanged.

No dispatch, merge, or live API execution happens in this commit.
---
 .../workflows/delete-retired-sms-package.yml  | 24 +++++++++++++------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/.github/workflows/delete-retired-sms-package.yml b/.github/workflows/delete-retired-sms-package.yml
index 18c237f..108646a 100644
--- a/.github/workflows/delete-retired-sms-package.yml
+++ b/.github/workflows/delete-retired-sms-package.yml
@@ -123,18 +123,28 @@ jobs:
             }
             core.info(`versions present: ${versions.length} (sample id=${versions.length > 0 ? versions[0].id : 'none'})`);
 
-            // 3) Delete the ENTIRE package, not individual versions. A
-            //    successful 204 confirms the deletion was accepted.
+            // 3) Delete the ENTIRE package, not individual versions, via the
+            //    documented REST route. The pinned runtime exposes no
+            //    github.rest.packages helper for this endpoint (run
+            //    35492786770 failed "is not a function"), so call
+            //    github.request with raw parameters; the runtime encodes
+            //    them and step 0 already verified this exact route's URL
+            //    construction. Require the documented 204 response before
+            //    treating the deletion as accepted.
+            let deleteResponse;
             try {
-              await github.rest.packages.deletePackageForOrganization({
-                org: owner,
-                package_type: packageType,
-                package_name: expectedName,
-              });
+              deleteResponse = await github.request(
+                'DELETE /orgs/{org}/packages/{package_type}/{package_name}',
+                { org: owner, package_type: packageType, package_name: expectedName },
+              );
             } catch (error) {
               failWith('package DELETE failed', error);
               return;
             }
+            if (deleteResponse.status !== 204) {
+              core.setFailed(`package DELETE returned status=${deleteResponse.status}, expected 204`);
+              return;
+            }
             core.info(`DELETE accepted (204) for "${expectedName}" (id=${meta.id})`);
 
             // 4) Bounded verification with the same token: at most five