[WIP] Test default token in cleanup-old-packages wrkflw #1535
Conversation
ivanzati
requested review from
AlexanderBarabanov and
mramotowski
as code owners
There was a problem hiding this comment.
Pull Request Overview
This PR modifies the cleanup-old-packages workflow to use the default GITHUB_TOKEN instead of a custom GHCR_CLEANUP_TOKEN secret for package deletion operations. This change is being tested to verify if the default token has sufficient permissions for GitHub Container Registry cleanup tasks.
Key Changes:
- Replaced
GHCR_CLEANUP_TOKENwithGITHUB_TOKENacross all cleanup operations - Added error handling with
continue-on-error: trueto prevent workflow failures during testing
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - name: Cleanup old packages | ||
| if: ${{ github.event.inputs.dry_run != 'true' && steps.prepare-versions.outputs.package_version_ids != '' }} | ||
| uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0 | ||
| continue-on-error: true |
There was a problem hiding this comment.
Adding continue-on-error: true masks failures during testing. While this might be intentional for the WIP phase, ensure this is removed before merging to production. Silent failures in cleanup operations could lead to package retention issues going unnoticed.
| - name: Cleanup untagged packages | ||
| if: ${{ github.event.inputs.dry_run != 'true' }} | ||
| uses: actions/delete-package-versions@e5bc658cc4c965c472efe991f8beea3981499c55 # v5.0.0 | ||
| continue-on-error: true |
There was a problem hiding this comment.
Adding continue-on-error: true masks failures during testing. While this might be intentional for the WIP phase, ensure this is removed before merging to production. Silent failures in cleanup operations could lead to package retention issues going unnoticed.
| continue-on-error: true |
| MIN_VERSIONS_TO_KEEP: ${{ github.event.inputs.min_versions_to_keep }} | ||
| PACKAGE_NAME: ${{ github.event.inputs.package_name }} | ||
| GH_TOKEN: ${{ secrets.GHCR_CLEANUP_TOKEN }} | ||
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} |
There was a problem hiding this comment.
The default GITHUB_TOKEN has limited permissions by default. Verify that the workflow has the packages: write permission granted in the workflow permissions section to successfully delete package versions. Without explicit permission grants, this token may lack sufficient privileges for package deletion operations.
| GH_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| GH_TOKEN: ${{ github.token }} |
📝 Description
Test default token to delete package version workflow
✨ Type of Change
Select the type of change your PR introduces:
🧪 Testing Scenarios
Describe how the changes were tested and how reviewers can test them too:
✅ Checklist
Before submitting the PR, ensure the following: