unb-libraries/container-image-pruner
Safely prune old per-build container images from GHCR (deletes hash-time build tags and their orphaned child manifests; never touches text/branch tags or anything a retained image references).
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| image-name | Full image reference ghcr.io/<owner>/<package>. Alternative to owner/package. | no | "" |
| owner | Repository owner (used when image-name is not given). | no | "" |
| package | Package name (used with owner). Empty processes every package under the owner. | no | "" |
| token | GitHub token with read:packages (+ delete:packages unless dry-run). | yes | — |
| older-than-days | Delete build images strictly older than this many days. | no | 60 |
| keep-at-least | Always keep at least this many of the most-recent build images. | no | 5 |
| dry-run | When true, only report the plan; delete nothing. | no | false |
| max-delete | Abort (delete nothing) if the plan exceeds this many deletions. | no | 500 |
| protect-subject-attestations | Also protect subject-linked attestations of retained images (extra fetches). | no | false |
| read-concurrency | Concurrency for read/manifest requests. | no | 8 |
| delete-concurrency | Concurrency for DELETE requests (kept low for secondary rate limits). | no | 3 |
| owner-type | Force owner kind: user or org (default: auto-detect). | no | "" |
| github-api-url | Override the GitHub REST API base URL (GitHub Enterprise Server). | no | "" |
| upload-audit-log | Upload the plan (and audit JSONL, when executing) as a build artifact. | no | true |
| artifact-name | Name of the uploaded artifact. | no | container-image-pruner-audit |
| artifact-retention-days | Retention for the uploaded artifact. | no | 14 |
| version | Release tag of the binary to download (default: derived from the crate version). | no | "" |
| binary-path | Advanced/testing: run this local binary and skip the release download+verify. | no | "" |
Outputs
| name | description |
|---|---|
| deleted | Number of versions actually deleted. |
| planned-delete | Number of versions the plan would delete. |
| status | Overall run status: clean | degraded | errored | aborted. |
| summary-json | Path to the JSON run summary (the plan/results). |
| audit-log | Path to the JSONL audit log (present only when executing). |