Gate PR Docker image publishing behind push-image label; add GHCR cleanup - #18
Merged
Conversation
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
There was a problem hiding this comment.
Pull request overview
Updates project documentation around Docker image publishing for pull requests and the cleanup policy for ephemeral GHCR artifacts.
Changes:
- Document a new PR image publishing gate via a
push-imagelabel. - Document weekly cleanup of ephemeral
pr-*tags and untagged manifests.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+139
to
+142
| Pull requests build and test images but do not publish them unless a maintainer adds the | ||
| `push-image` label, which publishes ephemeral `pr-NN` / `pr-NN-dev` tags (same-repo PRs | ||
| only). Ephemeral `pr-*` tags and untagged manifests are cleaned up weekly; version tags | ||
| are kept forever, so pinned deployments are never affected. |
Owner
Author
There was a problem hiding this comment.
Correct observation, but intentional: the matching workflow changes cannot be pushed from this automation session (its credentials lack the workflow scope for .github/workflows/ files). They were delivered to the maintainer as a git am-ready patch — see the note in the PR description. This PR should merge only once that patch commit lands on the branch, at which point the README and workflows agree.
Generated by Claude Code
- PR runs now build and test images without publishing. Adding the 'push-image' label to a same-repo PR publishes the pr-NN / pr-NN-dev tags (the 'labeled' event re-triggers the workflow). Fork PRs never push - their GITHUB_TOKEN cannot write packages, which previously would have failed the job outright. - Set retention-days: 1 on the dev-image tar artifacts, which are only consumed by the next job in the same run. - Add a weekly ghcr-cleanup workflow that deletes ephemeral pr-* tags and untagged manifests older than a week, complementing the post-push cleanup-untagged job (which never runs on PR events). Version and branch tags are never touched, so pinned deployments are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Changes the Docker publishing policy per discussion: PRs build and test images but no longer publish them by default.
push-imagelabel gate: on pull requests, thePush Dev Imagesjob and theproimage push only run when a maintainer adds thepush-imagelabel to a same-repo PR (thelabeledevent type re-triggers the workflow, so adding the label publishes without needing a new push). Fork PRs never push — theirGITHUB_TOKENcan't write packages, which previously would have failed the job outright on the first community PR touchingmagg/**.ghcr-cleanup.yml): deletes ephemeralpr-*tags and untagged manifests older than a week, usingdataaxiom/ghcr-cleanup-action(multi-arch-safe, with post-run validation). This complements the existingcleanup-untaggedjob, which runs after branch pushes but never on PR events. Version tags (1.2.3,1.2,*-dev-py3.x) and moving branch tags (dev,beta) are never touched, so pinned production deployments are unaffected. Manual dispatch supports a dry-run mode (default on).Setup after merge: create the
push-imagelabel (any color) in the repo's label settings.🤖 Generated with Claude Code
https://claude.ai/code/session_011JFaNeMxJCxXhQ3J9RQACR
Generated by Claude Code