Harden Workflow Security #65

	# Example taken from https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#managing-caches
	name: Cleanup Caches on PR Merge
	on:
	pull_request:
	types:
	- closed

	permissions: # added using https://github.com/step-security/secure-repo
	contents: read

	jobs:
	cleanup:
	runs-on: ubuntu-latest
	steps:
	- name: Harden Runner
	uses: step-security/harden-runner@eb238b55efaa70779f274895e782ed17c84f2895 # v2.6.1
	with:
	egress-policy: audit

	- name: Check out code
	uses: actions/[email protected]

	- name: Cleanup
	run: \|
	gh extension install actions/gh-actions-cache

	REPO=${{ github.repository }}
	BRANCH="refs/pull/${{ github.event.pull_request.number }}/merge"

	echo "Fetching list of cache key"
	cacheKeysForPR=$(gh actions-cache list -R $REPO -B $BRANCH -L 100 \| cut -f 1 )

	## Setting this to not fail the workflow while deleting cache keys.
	set +e
	echo "Deleting caches..."
	for cacheKey in $cacheKeysForPR
	do
	gh actions-cache delete $cacheKey -R $REPO -B $BRANCH --confirm
	done
	echo "Done"
	env:
	GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Provide feedback