cleanup.yml

name: cleanup tags
on:
  workflow_dispatch:
  push:
    branches:
      - master
    paths:
      - .github/workflows/cleanup.yml
permissions:
  contents: read
  packages: write

jobs:
  cleanup:
    if: ${{ github.repository_owner == 'CubeCoders' && github.ref == 'refs/heads/master' }}
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
    steps:
      - name: Delete named tags if they exist
        shell: bash
        env:
          ORG: cubecoders
          REPO: ampbase
          TAGS: 'debian-13'
        run: |
          set -u

          TOKEN=$(
            curl -s -H "Content-Type: application/json" -X POST \
              -d "{\"username\":\"${{ vars.DOCKERHUB_USERNAME }}\",\"password\":\"${{ secrets.DOCKERHUB_TOKEN }}\"}" \
              https://hub.docker.com/v2/users/login/ | jq -r .token
          )

          for tag in $TAGS; do
            echo "Processing tag: $tag"

            check_code=$(curl -s -o /dev/null -w "%{http_code}" \
              -H "Authorization: JWT $TOKEN" \
              "https://hub.docker.com/v2/repositories/$ORG/$REPO/tags/$tag/")

            if [[ "$check_code" == "200" ]]; then
              echo "Tag exists. Deleting…"
              del_code=$(curl -s -o /dev/null -w "%{http_code}" -X DELETE \
                -H "Authorization: JWT $TOKEN" \
                "https://hub.docker.com/v2/repositories/$ORG/$REPO/tags/$tag/")

              if [[ "$del_code" == "204" || "$del_code" == "202" ]]; then
                echo "Deleted: $tag"
              else
                echo "WARNING: Failed to delete $tag (HTTP $del_code). Continuing."
              fi

            elif [[ "$check_code" == "404" ]]; then
              echo "Tag not found: $tag — skipping."

            else
              echo "WARNING: Could not verify tag $tag (HTTP $check_code). Skipping."
            fi
          done

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false