Skip nightly cleanup when only the dev tag exists

[RAVEENSR]

Purpose

Describe the problems, issues, or needs driving this feature/fix and include links to related issues in the following format: Resolves issue1, issue2, etc.

The nightly "Cleanup Previous Nightly Images" job fails for amp-observer (see this run) with: You cannot delete the last tagged version of a package. You must delete the package instead. amp-observer was recently renamed from amp-traces-observer and has never been through a real release, so its only tag is the nightly 0.0.0-dev-* build the cleanup step is trying to delete, and GHCR refuses to remove a package's last remaining tag.

Goals

Describe the solutions that this feature/fix will introduce to resolve the problems described above

Skip the delete step (with a warning annotation) when a package's only existing tags are the 0.0.0-dev-* tags about to be removed, instead of failing the job. Cleanup resumes automatically once the package has a real release tag to anchor on.

Approach

Describe how you are implementing the solutions. Include an animated GIF or screenshot if the change affects the UI (email documentation@wso2.com to review all UI text). Include a link to a Markdown file or Google doc if the feature write-up is too long to paste here.

Added a check-tags step alongside the existing package-existence probe in cleanup-images. It lists a package's tags via gh api .../versions --paginate and compares the total tag count against the count matching the 0.0.0-dev-* pattern. If every existing tag is a dev tag, it sets skip=true, and the delete step's if: condition now also checks that output before running.

User stories

Summary of user stories addressed by this change

N/A - CI/ops-only change, no user-facing behavior.

Release note

Brief description of the new feature or bug fix as it will appear in the release notes

Fix nightly image cleanup so it no longer fails for packages that only have nightly dev tags and no release tag yet.

Documentation

Link(s) to product documentation that addresses the changes of this PR. If no doc impact, enter “N/A” plus brief explanation of why there’s no doc impact

N/A - internal CI workflow change only, no product documentation impact.

Training

Link to the PR for changes to the training content in https://github.com/wso2/WSO2-Training, if applicable

N/A - no training content affected.

Certification

Type “Sent” when you have provided new/updated certification questions...

N/A - no certification exam impact.

Marketing

Link to drafts of marketing content...

N/A - internal CI fix, nothing user-facing to promote.

Automation tests

• Unit tests

  Code coverage information

N/A - GitHub Actions workflow change, no unit test harness applies.

• Integration tests

  Details about the test cases and coverage

Verified against the failing run's logs that amp-observer currently has exactly one tagged version (the dev tag) versus zero for every other tag category, confirming the new check would set skip=true for it. Will also observe the next scheduled nightly run to confirm the job goes green.

Security checks

• Followed secure coding standards in http://wso2.com/technical-reports/wso2-secure-engineering-guidelines? yes
• Ran FindSecurityBugs plugin and verified report? N/A - GitHub Actions YAML change, not covered by that tooling
• Confirmed that this PR doesn't commit any keys, passwords, tokens, usernames, or other secrets? yes

Samples

Provide high-level details about the samples related to this feature

N/A - no sample changes.

Related PRs

List any other related PRs

N/A

Migrations (if applicable)

Describe migration steps and platforms on which migration has been tested

N/A - no data or schema migrations.

Test environment

List all JDK versions, operating systems, databases, and browser/versions on which this feature/fix was tested

N/A - GitHub Actions workflow; verified via gh run view log inspection, no separate test environment applicable.

Learning

Describe the research phase and any blog posts, patterns, libraries, or add-ons you used to solve the problem.

Compared the failing amp-observer package's tag list (only 0.0.0-dev-*) against a package with full release history (amp-console, which retains v0.18.0 etc.), and traced amp-observer's package name to a recent rename (agent-manager-observer, commit 27ea5ee) that post-dates the last release cut (v0.18.0).

Summary by CodeRabbit

• Bug Fixes
  • Improved nightly container image cleanup to avoid deleting the final tagged version of a package.
  • Added safeguards to skip cleanup when no fallback tag is available, preventing cleanup failures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: be922b2c-c6bb-4600-8b02-92a9c14f77a8

📥 Commits

Reviewing files that changed from the base of the PR and between fa473da and dced312.

📒 Files selected for processing (1)

• .github/workflows/nightly.yml

---

📝 Walkthrough

Walkthrough

The nightly cleanup workflow now checks GHCR package tags before deleting 0.0.0-dev-* tags and skips deletion when those are the package’s only tagged versions.

Changes

GHCR cleanup safeguard

Layer / File(s)	Summary
Prevent deletion of the last tagged version .github/workflows/nightly.yml	The workflow counts package versions, identifies nightly-only packages, sets a skip output, and runs tag deletion only when skipping is not requested.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• wso2/agent-manager#1345: Updates the same nightly GHCR tag-deletion logic with related safeguards and skip conditions.

Suggested reviewers: menakaj, hanzjk

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the main change: skipping nightly cleanup when only the dev tag exists.
Description check	✅ Passed	The description follows the template and includes filled sections for purpose, goals, approach, testing, and notes.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}