fix: clean registry buildcache tags on PR close

.github/workflows/cleanup-buildcache.yml

@@ -0,0 +1,119 @@
+name: Cleanup Buildcache
+
+on:
+  pull_request:
+    types: [closed]
+    branches:
+    - master
+
+permissions:
+  packages: write
+
+jobs:
+  cleanup-buildcache:
+    name: Cleanup buildcache for PR ${{ github.event.pull_request.number }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Inject enhanced GitHub environment variables
+        uses: rlespinasse/github-slug-action@v5
+      - name: Cleanup buildcache tags from ghcr.io
+        env:
+          GH_TOKEN: ${{ secrets.GHCR_REGISTRY_TOKEN }}
+        run: |
+          # Delete buildcache tags for this PR from ghcr.io
+          # The buildcache image is at ghcr.io/eic/buildcache
+          # Tags follow patterns:
+          #   - Base images: {BUILD_IMAGE}-{GITHUB_REF_POINT_SLUG}-{arch}
+          #   - EIC images: {BUILD_IMAGE}{ENV}-{BUILD_TYPE}-{GITHUB_REF_POINT_SLUG}-{arch}
+          # For PRs, GITHUB_REF_POINT_SLUG is the PR number (e.g., "123")
+          # The pattern contains("-{PR_NUM}-") matches both formats
+
+          echo "Cleaning up buildcache tags for PR #${GITHUB_REF_POINT_SLUG} from ghcr.io"
+
+          # List all versions of the buildcache package
+          echo "Fetching buildcache package versions..."
+          VERSIONS=$(gh api \
+            -H "Accept: application/vnd.github+json" \
+            -H "X-GitHub-Api-Version: 2022-11-28" \
+            "/orgs/eic/packages/container/buildcache/versions?per_page=100" \
+            --paginate \
+            --jq --arg pr_num "${GITHUB_REF_POINT_SLUG}" '.[] | select(.metadata.container.tags[]? | contains("-\($pr_num)-")) | .id')
+
+          if [ -z "$VERSIONS" ]; then
+            echo "No buildcache versions found for PR #${GITHUB_REF_POINT_SLUG} in ghcr.io"
+          else
+            # Delete each matching version
+            echo "Found buildcache versions to delete from ghcr.io:"
+            for version_id in $VERSIONS; do
+              # Get the tags for this version for logging
+              TAGS=$(gh api \
+                -H "Accept: application/vnd.github+json" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "/orgs/eic/packages/container/buildcache/versions/${version_id}" \
+                --jq '.metadata.container.tags[]? | select(. != null)' 2>/dev/null | tr '\n' ',' | sed 's/,$//')
+
+              echo "  Deleting version ${version_id} with tags: ${TAGS}"
+
+              gh api \
+                --method DELETE \
+                -H "Accept: application/vnd.github+json" \
+                -H "X-GitHub-Api-Version: 2022-11-28" \
+                "/orgs/eic/packages/container/buildcache/versions/${version_id}" \
+                || echo "  Warning: Failed to delete version ${version_id}"
+            done
+          fi
+
+          echo "Buildcache cleanup from ghcr.io completed for PR #${GITHUB_REF_POINT_SLUG}"
+
+      - name: Cleanup buildcache tags from eicweb.phy.anl.gov
+        env:
+          GITLAB_TOKEN: ${{ secrets.GITLAB_TOKEN }}
+        run: |
+          # Delete buildcache tags for this PR from eicweb.phy.anl.gov GitLab Container Registry
+          # The buildcache image is at eicweb.phy.anl.gov/containers/eic_container/buildcache
+          # Tags follow patterns:
+          #   - Base images: {BUILD_IMAGE}-{GITHUB_REF_POINT_SLUG}-{arch}
+          #   - EIC images: {BUILD_IMAGE}{ENV}-{BUILD_TYPE}-{GITHUB_REF_POINT_SLUG}-{arch}
+          # For PRs, GITHUB_REF_POINT_SLUG is the PR number (e.g., "123")
+          # The pattern contains("-{PR_NUM}-") matches both formats
+
+          echo "Cleaning up buildcache tags for PR #${GITHUB_REF_POINT_SLUG} from eicweb.phy.anl.gov"
+
+          GITLAB_API="https://eicweb.phy.anl.gov/api/v4"
+          GITLAB_PROJECT_ID="290"  # containers/eic_container project ID
+
+          # List all repository tags for the buildcache image
+          echo "Fetching buildcache repository tags..."
+          REPOSITORY_ID=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
+            "${GITLAB_API}/projects/${GITLAB_PROJECT_ID}/registry/repositories" \
+            | jq -r '.[] | select(.name == "buildcache") | .id')
+
+          if [ -z "$REPOSITORY_ID" ]; then
+            echo "Warning: Could not find buildcache repository in GitLab registry"
+            exit 0
+          fi
+
+          echo "Found buildcache repository ID: ${REPOSITORY_ID}"
+
+          # Fetch all tags and filter for this PR
+          TAGS_TO_DELETE=$(curl -s --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
+            "${GITLAB_API}/projects/${GITLAB_PROJECT_ID}/registry/repositories/${REPOSITORY_ID}/tags?per_page=100" \
+            | jq -r --arg pr_num "${GITHUB_REF_POINT_SLUG}" '.[] | select(.name | contains("-\($pr_num)-")) | .name')
+
+          if [ -z "$TAGS_TO_DELETE" ]; then
+            echo "No buildcache tags found for PR #${GITHUB_REF_POINT_SLUG} in eicweb.phy.anl.gov"
+          else
+            # Delete each matching tag
+            echo "Found buildcache tags to delete from eicweb.phy.anl.gov:"
+            for tag in $TAGS_TO_DELETE; do
+              echo "  Deleting tag: ${tag}"
+
+              curl -s -X DELETE --header "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
+                "${GITLAB_API}/projects/${GITLAB_PROJECT_ID}/registry/repositories/${REPOSITORY_ID}/tags/${tag}" \
+                || echo "  Warning: Failed to delete tag ${tag}"
+            done
+          fi
+
+          echo "Buildcache cleanup from eicweb.phy.anl.gov completed for PR #${GITHUB_REF_POINT_SLUG}"

docs/build-pipeline.md

@@ -130,6 +130,8 @@ cache-from: |
 cache-to: type=registry,ref=ghcr.io/eic/buildcache:{image}-{branch}-{arch},mode=max
 ```
 
+**Buildcache Cleanup**: When a pull request is closed or merged, the `cleanup-buildcache` workflow automatically removes all buildcache tags associated with that PR from both ghcr.io and eicweb.phy.anl.gov registries. This prevents buildcache accumulation and keeps the registries clean.
+
 ### Build Mount Cache
 
 Uses [buildkit-cache-dance](https://github.com/reproducible-containers/buildkit-cache-dance) to persist mount caches:
@@ -150,13 +152,21 @@ Pre-built binaries are stored in OCI registries:
 
 ## Workflow Triggers
 
+### build-push workflow
+
 | Trigger | Behavior |
 |---------|----------|
 | Schedule (cron) | Every 6 hours - nightly builds |
 | Push to master | Build and push with `pipeline-*` tag |
 | Pull Request | Build with `unstable-pr-*` tag |
 | Manual Dispatch | Allows overriding EDM4EIC, EICRECON, JUGGLER versions |
 
+### cleanup-buildcache workflow
+
+| Trigger | Behavior |
+|---------|----------|
+| Pull Request closed | Automatically removes all buildcache tags for the PR from ghcr.io and eicweb.phy.anl.gov |
+
 ## Environment Matrix
 
 The EIC job builds the following matrix: