Conversation
alexcos20
requested review from
andreip136,
bogdanfazakas,
denisiuriet,
giurgiur99 and
ndrpp
as code owners
|
/run-security-scan |
alexcos20
left a comment
alexcos20
left a comment
There was a problem hiding this comment.
AI automated code review (Gemini 3).
Overall risk: medium
Summary:
This pull request introduces a new GitHub Actions workflow (ghcr_cleanup.yml) designed to manage and clean up old Docker images stored in the GitHub Container Registry (GHCR). This cleanup workflow is configured to run manually via workflow_dispatch, and it specifically excludes latest, main, and v* tagged images from deletion, while removing untagged or partial images older than one month. Additionally, the docker.yml workflow has been modified to remove the workflow_dispatch trigger, meaning multi-platform builds will now only be executed on pushes to the main branch.
Comments:
• [INFO][other] The workflow_dispatch trigger has been removed from this workflow. This means the Docker Multi Platform Builds can no longer be manually triggered and will only run on pushes to the main branch. Please confirm this change in triggering mechanism is intentional and desired for this workflow.
• [INFO][style] The secret GHCR_PUSH_TOKEN is used for authentication for both GHCR login and the cleanup action itself. While it might possess the necessary delete permissions, the name GHCR_PUSH_TOKEN could be slightly misleading given its primary use here is for cleanup/deletion. Consider renaming it to something like GHCR_CLEANUP_TOKEN or GHCR_WRITE_TOKEN to better reflect its function and required permissions, ensuring clarity for future maintainers.
• [INFO][other] The exclude-tags: latest,main,v* configuration is crucial for preventing the deletion of important images. This looks good for standard release management. Please confirm if there are any other specific tag patterns (e.g., specific branch-based tags like feature/XYZ or release-candidate-vX.Y) that should also be explicitly excluded from deletion to avoid accidentally removing potentially valuable images.
• [INFO][style] For improved supply chain security and stability, consider pinning the dataaxiom/ghcr-cleanup-action to a specific commit SHA (e.g., dataaxiom/ghcr-cleanup-action@<commit_sha>) instead of @v1. This practice ensures your workflow always uses the exact same version of the action, preventing unexpected behavior if the v1 tag were to be updated by the action maintainer.
1 participant
Uh oh!
There was an error while loading. Please reload this page.