fix: clean registry buildcache tags on PR close

[Copilot]

Buildcache tags accumulate in container registries (ghcr.io and eicweb.phy.anl.gov) without timestamps for automatic eviction. This adds a workflow to delete them when PRs close or via manual trigger.

Implementation

• New workflow .github/workflows/cleanup-buildcache.yml triggers on:
  • pull_request: types[closed] - automatic cleanup when PR closes
  • workflow_dispatch - manual cleanup with branch slug input
• Slug Action Integration: Explicitly includes rlespinasse/github-slug-action@v5 (for pull_request events) to ensure GITHUB_REF_POINT_SLUG is set
• GitHub Container Registry: Uses GitHub Packages API to delete versions matching tag pattern -{GITHUB_REF_POINT_SLUG}-
• GitLab Container Registry: Uses GitLab API v4 to delete tags from project 290 (containers/eic_container)
• Tag pattern: Matches all buildcache variants using GITHUB_REF_POINT_SLUG (derived from branch name):
  • Base images: {BUILD_IMAGE}-{GITHUB_REF_POINT_SLUG}-{arch}
  • EIC images: {BUILD_IMAGE}{ENV}-{BUILD_TYPE}-{GITHUB_REF_POINT_SLUG}-{arch}

Example

For a PR from branch "my-feature" (where GITHUB_REF_POINT_SLUG = "my-feature"), deletes:

debian_stable_base-my-feature-amd64
debian_stable_base-my-feature-amd64_v3
debian_stable_base-my-feature-arm64
cuda_devel-my-feature-amd64
eic_ci-default-my-feature-amd64
eic_ci-default-my-feature-amd64_v3
eic_xl-default-my-feature-arm64
...

For manual cleanup via workflow_dispatch, provide the branch slug (e.g., "old-feature") as input to delete buildcache tags for that branch.

The cleanup workflow uses the same GITHUB_REF_POINT_SLUG variable as the build-push workflow, ensuring pattern consistency between tag creation and deletion.

Authentication uses existing secrets: GHCR_REGISTRY_TOKEN and GITLAB_TOKEN

Documentation

Updated docs/build-pipeline.md to document cleanup workflow and caching strategy.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Clean registry buildcache when PR merged or closed</issue_title>
<issue_description>Is your feature request related to a problem? Please describe.
We write the buildcache for pull requests to the registry as tags for the buildcache image at https://eicweb.phy.anl.gov/containers/eic_container/container_registry/143. This accumulates without a clear way to clean up since the buildcache tags don't have a timestamp set that could be used for automatic eviction. This also affects ghcr.io.

Describe the solution you'd like
When a pull request is merged, we should explicitly remove the buildcache tags from the registries (both eicweb and ghcr.io).

Describe alternatives you've considered
An alternative approach is to have a periodic scheduled workflow that removes the buildcache entries that do not have a corresponding open pull request.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Clean registry buildcache when PR merged or closed #89

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.