Shared Cleanup Packages

# Weekly pruning of untagged GHCR container versions.
#
# Copy into .github/workflows/ of any repository that publishes a container
# package. It defaults to the repository's own name, so most repos need no edits.
#
# dry_run stays true until you have read one plan and agree with it. The
# scheduled run only ever reports; deleting means dispatching by hand with
# dry_run unchecked. Retention is the reusable workflow's default (10) — change
# it there, or call the workflow directly, rather than threading a number input
# through a dispatch where an empty value would have to be coerced.
name: Cleanup Packages

on:
  schedule:
    # Sunday 04:00 UTC — after the week's releases, before Monday.
    - cron: '0 4 * * 0'
  workflow_dispatch:
    inputs:
      dry_run:
        description: 'Only report what would be deleted'
        required: false
        type: boolean
        default: true

# Runs on one ref queue and run one at a time. Never cancel one mid-flight:
# a half-finished cleanup or scan upload is worse than a late one.
concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: false

permissions:
  packages: write

jobs:
  cleanup:
    uses: Codehunters-IO/ci-templates/.github/workflows/shared-cleanup-packages.yml@v2
    with:
      # Tagged versions are never candidates unless keep_releases is set, so
      # semver and rolling tags are safe regardless of the other inputs.
      # keep_releases: 2   # keep the two newest X.Y.Z releases, retire the rest
      # On the scheduled run `inputs` is empty, so this evaluates to true and the
      # cron only ever reports. Deleting requires dispatching it by hand.
      dry_run: ${{ inputs.dry_run != false }}
    secrets: inherit