dataaxiom/Ghcr.io Cleanup Action
Delete untagged/tagged images from the GitHub Container Registry. Supports multi-architecture and attestation images.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| token | Token to authenticate with the ghcr.io registry and the GitHub API | yes | ${{ github.token }} |
| owner | Owner of the package (user or organization). Defaults to project owner | no | — |
| repository | Optional. Used only for diagnostic log strings; defaults to the calling workflow's repository name. The cleanup logic determines the package's owner type and your token's identity directly, so this input no longer affects which packages are touched. Safe to omit (especially for cross-account cleanup where the target package isn't linked to any repository). | no | — |
| package | Comma-separated list of packages to cleanup. Support dynamic packages (wildcard or regular expression) by enabling the expand-packages option. | no | — |
| packages | Alternative name for package option | no | — |
| expand-packages | Enable wildcard or regular expression support on the package(s) option to support dynamic package selection. Requires use of a Personal Access Token (PAT) for the token value. | no | — |
| delete-tags | Comma-separated list of tags to delete (supports wildcard syntax), can be abbreviated as `tags`. A regular expression selector can be used instead by setting the `use-regex` option to true | no | — |
| tags | Short form of `delete-tags` input option | no | — |
| exclude-tags | Comma-separated list of tags strictly to be preserved/excluded from deletion (supports wildcard syntax). A regular expression selector can be used instead by setting the `use-regex` option to true | no | — |
| keep-n-untagged | Number of untagged images to keep (sorted by date, keeping newest) | no | — |
| keep-n-tagged | Number of tagged images to keep (sorted by date, keeping newest) | no | — |
| delete-untagged | Delete all untagged images. This option is set to true when no other delete or keep options are set (true/false) | no | — |
| delete-ghost-images | Delete multi architecture images where all underlying platform images are missing (true/false) Default: false | no | — |
| delete-partial-images | Delete multi architecture images where some (but not all) underlying platform images are missing (true/false) Default: false | no | — |
| delete-orphaned-images | Delete orphaned images (referrers/cosign etc) where the parent image doesn't exist. Uses a tagged based check. | no | — |
| older-than | Only include packages for processing that are older than this value. Use the following format samples: 50 seconds, 15 days, 6 months, 2 years | no | — |
| use-regex | Use a regex expression in place of wildcard matcher for package, delete-tags and exclude-tags options (true/false) Default: false | no | — |
| skip-regex-checks | Skip the safety checks (length cap and ReDoS heuristic) applied to user-supplied regex patterns when use-regex is true. Set to true only if you intentionally need a very large or complex pattern (true/false) Default: false | no | — |
| validate | Validate all multi-architecture images manifests by checking their digests are present in the registry (true/false) Default: false | no | — |
| dry-run | Simulate action - does not remove any packages (true/false) Default: false | no | — |
| log-level | Log level (error/warn/info/debug) Default: info | no | — |
| registry-url | Container registry URL (defaults: https://ghcr.io) | no | — |
| github-api-url | GitHub API URL (defaults: https://api.github.com) | no | — |
Outputs
no outputs