delete-ecs-task-defs.yml

name: Delete ECS task definitions

on:
  workflow_dispatch:
  schedule:
    - cron: "0 5 * * 0" # 5am Sunday UTC

env:
  AWS_REGION: ca-central-1

permissions:
  id-token: write
  contents: read

jobs:
  delete-ecs-task-definitions:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        include:
          - account: '687401027353'
          - account: '957818836222'

    steps:
      - name: Checkout
        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1

      - name: Configure AWS credentials using OIDC
        uses: aws-actions/configure-aws-credentials@010d0da01d0b5a38af31e9c3470dbfdabdecca3a # v4.0.1
        with:
          role-to-assume: arn:aws:iam::${{ matrix.account }}:role/platform-forms-client-apply
          role-session-name: ECSTaskDefDelete
          aws-region: ${{ env.AWS_REGION }}

      # Retrieves all ACTIVE task definitions except for the 5 most recent
      - name: Get ACTIVE ECS task definitions
        env:
          TASK_STATUS: ACTIVE
          TASKS_TO_KEEP: 6 # 1 greater than number to keep
        run: |
            aws ecs list-task-definitions \
                --sort ASC \
                --status ${{ env.TASK_STATUS }} \
                --region ${{ env.AWS_REGION }} \
                --no-cli-pager \
                | jq -r '(.taskDefinitionArns[:length-${{ env.TASKS_TO_KEEP }}])[]' > task-def-active-arns.txt

      - name: Set ECS tasks to INACTIVE
        run: |
          ./bin/delete-ecs-task-defs.sh DEREGISTER task-def-active-arns.txt

      # Retrieves all INACTIVE task definitions except for the 100 most recent
      - name: Get INACTIVE ECS task definitions
        env:
          TASK_STATUS: INACTIVE
          TASKS_TO_KEEP: 101 # 1 greater than number to keep
        run: |
            aws ecs list-task-definitions \
                --sort ASC \
                --status ${{ env.TASK_STATUS }} \
                --region ${{ env.AWS_REGION }} \
                --no-cli-pager \
                | jq -r '(.taskDefinitionArns[:length-${{ env.TASKS_TO_KEEP }}])[]' > task-def-inactive-arns.txt

      - name: Delete INACTIVE ECS task definitions
        run: |
          ./bin/delete-ecs-task-defs.sh DELETE task-def-inactive-arns.txt