pr-image-cleanup.yml

---
name: Cleanup Pull Request Images

on:
  pull_request:
    types: [closed]

permissions:
  contents: read

env:
  REGISTRY: ghcr.io

jobs:
  delete-images:
    runs-on: ubuntu-latest
    strategy:
      matrix:
        flavor: ["cpp", "rust"]
    permissions:
      packages: write
    steps:
      - uses: sigstore/cosign-installer@59acb6260d9c0ba8f4a2f9d9b48431a222b68e20 # v3.5.0
      - uses: docker/login-action@e92390c5fb421da1463c202d546fed0ec5c39f20 # v3.1.0
        with:
          registry: ${{ env.REGISTRY }}
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - run: cosign clean -f --type=signature "${{ env.REGISTRY }}/${{ github.repository }}-${{ matrix.flavor }}:pr-${{ github.event.pull_request.number }}"
      - uses: bots-house/ghcr-delete-image-action@3827559c68cb4dcdf54d813ea9853be6d468d3a4 # v1.1.0
        with:
          owner: ${{ github.repository_owner }}
          name: ${{ github.event.repository.name }}-${{ matrix.flavor }}
          token: ${{ secrets.GITHUB_TOKEN }}
          tag: pr-${{ github.event.pull_request.number }}