Garbage-collect old images #86

	name: Garbage-collect old images

	on:
	schedule:
	- cron: '27 2 * * 0'
	workflow_dispatch:

	jobs:
	read_tags:
	name: Read tags from build-matrix.json
	runs-on: ubuntu-latest
	outputs:
	supported_tags_regex: ${{ steps.get_tags.outputs.supported_tags_regex }}
	steps:
	- uses: actions/checkout@v4
	with:
	show-progress: false
	- id: get_tags
	run: \|
	# Construct a regex matching only the supported tags
	# from build-matrix.json, allowing optional suffixes (commit shas).
	# Example output regex: ^((3\.2\|3\.3)(-.*)?\|latest\|keep-me)$
	# Examples of matching tags: 3.3, 3.3-acecafe, 3.2-facedbadbeef172900000000
	echo "supported_tags_regex=^(($(
	jq <build-matrix.json -cr '[.version[].rubyver[:2] \| join("\\.")] \| join("\|")'
	))(-.*)?\|$(
	jq <build-matrix.json -cr '[.version[].extra \| select(length > 0)] \| join("\|")'
	))\$" >> "$GITHUB_OUTPUT"

	gc_old_images:
	name: GC old images
	runs-on: ubuntu-latest
	needs: read_tags
	permissions:
	packages: write
	strategy:
	matrix:
	pkg:
	- govuk-ruby-base
	- govuk-ruby-builder
	steps:
	- uses: actions/delete-package-versions@v5
	name: GC untagged images except 20 most recent
	with:
	package-name: ${{ matrix.pkg }}
	package-type: container
	min-versions-to-keep: 20 # Mostly for attestations (.att).
	delete-only-untagged-versions: 'true'
	- uses: actions/delete-package-versions@v5
	name: GC tagged images for no-longer-supported tags
	with:
	package-name: ${{ matrix.pkg }}
	package-type: container
	min-versions-to-keep: 10
	ignore-versions: ${{ needs.read_tags.outputs.supported_tags_regex }}

Provide feedback