✨ Improve docker image cleanup script (#1977)

* ⚗️ Experiment on dev #1770

* 🐛 Fix wrong image name #1770

* ⚗️ Experiment deleting old packages from dev #1770

* ⚗️ Experiment keeping 7 images #1770

* ⚗️ Experiment keep-at-least with skip-tags #1770

* ⚗️ Experiment with keep-at-least 1 #1770

* ✨ Run script every sunday at midnight #1770

* ✨ Replace script and always keep latest tags #1770

* 🚚 Rename filename #1770

.github/workflows/ghcr-cleanup.yaml

@@ -1,29 +1,45 @@
-name: Delete old container images
-
+name: Delete old ghrc images
 on:
   workflow_dispatch:
-  # schedule:
-  #   - cron: '0 0 * * *' # every day at midnight
-
+  schedule:
+    - cron: '0 0 * * 0' # every sunday at midnight
+permissions:
+  id-token: write
 jobs:
   clean-ghcr:
     name: Delete old unused container images
     runs-on: ubuntu-latest
     env:
       SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
     steps:
-      - name: Delete containers older than a week 🗑
+      - name: Checkout internal 🛎️
+        id: checkout-internal
+        uses: actions/checkout@v3
+        with:
+          repository: 'equinor/energyvision-internal'
+          ref: main
+          token: ${{ secrets.PADMS_PAT }}
+
+      - name: Get tags to keep from latest-prod-tags.json
+        id: get-tags
+        run: |
+          TAGS=$(jq -r '[.web + .studio | unique[]] | join(", ")' latest-prod-tags.json)
+          echo "TAGS_TO_KEEP=$TAGS" >> $GITHUB_ENV
+          echo "TAGS TO KEEP: $TAGS"
+
+      - name: Clean up Docker images
         id: delete-containers
-        uses: snok/container-retention-policy@v1
+        uses: snok/container-retention-policy@v2
         with:
-          image-names: energyvision/web-global,energyvision/web-global-test,energyvision/web-germany,energyvision/web-brazil,energyvision/web-argentina,energyvision/web-poland,energyvision/web-equinorfunds,energyvision/web-japan,energyvision/web-production,energyvision/web,energyvision/web-global-development,energyvision/web-southkorea,energyvision/web-storage,energyvision/studio-germany,energyvision/studio-brazil,energyvision/studio-argentina,energyvision/studio-poland,energyvision/studio-equinorfunds,energyvision/studio-japan,energyvision/studio-storage,energyvision/studio-global-development,energyvision/studio-southkorea,energyvision/studio-global-test
-          #image-names: energyvision/web-global-development,energyvision/studio-global-development
-          cut-off: A week ago UTC
+          token: ${{ secrets.PADMS_PAT }}
           account-type: org
           org-name: Equinor
+          image-names: energyvision/*
+          cut-off: a week ago UTC
           keep-at-least: 5
-          untagged-only: false
-          token: ${{ secrets.PADMS_PAT }}
+          skip-tags: ${{ env.TAGS_TO_KEEP }}, *-latest
+          # dry-run: true
+
       - name: log-errors-to-slack 📄
         uses: act10ns/slack@v2
         with: