build-test-publish.yml

name: Build, Test, Publish

on:
  push:

permissions:
  contents: read

defaults:
  run:
    # Setting an explicit bash shell ensures GitHub Actions enables pipefail mode too, rather
    # than only error on exit. This is important for UX since this workflow uses pipes. See:
    # https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idstepsshell
    shell: bash

jobs:

  publish:
    runs-on: ubuntu-22.04
    steps:
      - name: Install crane
        uses: buildpacks/github-actions/setup-tools@v5.4.0
      - name: Log into internal registry
        run: |
          REGISTRY_TOKEN=$(
            curl -sSf --retry 3 --retry-delay 1 --retry-all-errors --connect-timeout 3 \
              -X POST -d '{"username":"${{ secrets.SERVICE_TOKEN_USER_NAME }}", "password":"${{ secrets.SERVICE_TOKEN_PASSWORD }}"}' \
              '${{ secrets.SERVICE_TOKEN_ENDPOINT }}' \
              | jq --exit-status -r '.raw_id_token'
          )
          echo "${REGISTRY_TOKEN}" | docker login '${{ secrets.REGISTRY_HOST }}' -u '${{ secrets.REGISTRY_USER }}' --password-stdin
      - name: Delete unused internal images by digest
        run: |
          set -x
          # heroku-18:builder
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-18@sha256:32771207cd33a076a5898a83687473cf9353bf340e78ba875f12bb55592d2600'

          # heroku-18:build
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-18@sha256:4d7adfa03d59cdab8f9b938cba9923b215bc3abaa049cf1da56df9f836ad98d6'

          # heroku-18:run
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-18@sha256:e33a0c2615bb37c01c0df6c2f10caa108bb752f69b5efe94b1d40a4e9d7384d0'

          # heroku-20:builder
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-20@sha256:0194d86a97bfb3faa8fe3e512f1fdde3a0179e12d748c0b549238c264319a686'

          # heroku-20:build
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-20@sha256:fbafc9cfcc09db03c60bdc26b2d9a70384d10c87e8065d931349fc9d6e40e254'

          # heroku-20:run
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-20@sha256:ad8a891f3714c3fc81f9b42461cb03ef35912639556b309129772f68a7b24068'

          # heroku-22:builder
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-22@sha256:a7ccf5f4ea9794a7628f4f940bf2298123c969df5821f7ea1b72f643e3c08cd3'

          # heroku-22:build
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-22@sha256:eeaba2cff9d7b3591a37fb72c15bfcfdbf7eee3e98b7f7f4a09adbb20040a89d'

          # heroku-22:run
          crane delete '${{ secrets.REGISTRY_HOST }}/s/${{ secrets.SERVICE_TOKEN_USER_NAME }}/heroku-22@sha256:b4bebb3f92aaf3ac88ede26b46291427a462490e890802e1c7bd087de439c48f'