v3.0.0

v3.0.0

Disclaimer: This release breaks the API of the action to a large degree. It might be wise to run the action with dry-run: true after upgrading.

This release is a complete rewrite of the action, tackling most if not all open issues in the issue tracker. Some of the highlights include:

• Simplifying and consolidating the inputs of the action
• Improving the runtime performance, and the initialization time of the action in CI
• Support for multi-platform packages
• Support for new token types (secrets.GITHUB_TOKEN and Github app tokens)
• Much better handling of GitHub API rate limits

💥 There are a lot of breaking changes, so we've included a migration guide at the bottom of this post, to make things a bit simpler.

Since the release introduces a few thousand lines of code, we expect there may be a few things left to iron out. If you run into any problems, please share them in the v3 release issue.

---

In addition to what's mentioned above, other new features and changes include:

• Significant effort has been spent on improving the logging, to give better insights into what exactly is happening
• Updated license from BSD-3 to MIT.
• The available syntax for image-names and image-tags previously allowed wildcards (using the * character). We now also allow the ? character to express a single-character wildcard. For example, the pattern ca? will match car and cat. See the wildmatch docs for details.

In addition to changing the inputs of the action (more details below), there are a few other breaking changes:

• We'll no longer maintain mutable major and minor version tags for the action. There will be no v3 target for the action, just v3.0.0 and other exact versions. Mutable major version tags are generally hard to maintain and not much safer than tracking the main branch, so more precise tag tracking should reduce the likelihood of broken runs going forward. Paired with dependabot, upgrading should not be much harder than it has been.
• The needs-assistance output was deleted

And in terms of performance improvements:

• The action has been rewritten from a composite action to a container action, and the total size of the new image is < 10Mi.
• The action would previously take ~30 seconds to initialize and would require a Python runtime. The action now starts in less than a second, and runs as a standalone binary.
• The runtime of the action has been reduced, and assuming we need to delete less than 180 package versions, the action completes in, at most, a few seconds. See this example of a recent run. When we have to delete more than 180 package versions, there's a minute of waiting for every 180 new package versions, as a consequence of GitHub's secondary API rate limits. See the new README for details.

Migration guide

• The account-type and org-name inputs have been replaced with account, which should be set to the literal string "user" if you previously used account-type: personal and to the organization name otherwise:

  - account-type: personal
  + account: user

  or

  - account-type: organization
  - org-name: acme
  + account: acme

• The filter-tags key has been renamed to image-tags

  - filter-tags: *-prod
  + image-tags: "*-prod"

• The token-type input has been removed. If you previously used token-type: github-token, then you can now instead pass the secret value to token and have the type of token be auto-detected:

  - token-type: github-token
  + token: ${{ secrets.GITHUB_TOKEN }}

  In other words, we've consolidated token-type and token into a single arg.

• The skip-tags input has been removed. If you previously used skip-tags: latest, you should now specify a negative glob pattern in image-tags.

  - filter-tags: l*
  - skip-tags: latest
  + image-tags: "l* !latest"

  In other words, we've consolidated the two arguments, by adding support for the ! operator, which means "not".

• The filter-include-untagged and untagged-only inputs were removed.

  filter-include-untagged previously enabled you to opt-out of deleting untagged images, while untagged-only would allow you to opt-out of deleting tagged images. This was a bit confusing, even for me.

  To make things simpler, these have been collapsed into one argument, called tag-selection which accepts the string values tagged, untagged, or both.

  - filter-include-untagged: true
  - untagged-only: false
  + tag-selection: both

  or

  - filter-include-untagged: true
  - untagged-only: true
  + tag-selection: untagged

• The cut-off input no longer accepts human-readable datetimes. Instead, it accepts the inputs listed here. For example:

  - cut-off: two hours and 5 minutes ago UTC+2
  + cut-off: 2h 5m

  or

  - cut-off: One week ago UTC
  + cut-off: 1w

  There is no longer timezone support built-into this option. All durations are relative to the current time, UTC.

• The keep-at-least argument was renamed keep-n-most-recent to make clearer what it does

  - keep-at-least: 5
  + keep-n-most-recent: 5

v2.2.1

What's Changed

• fix: default token-type by @ChandlerFerry in #71

New Contributors

• @ChandlerFerry made their first contribution in #71

Full Changelog: v2...v2.2.1

v2.2.0

What's Changed

This new version of the action introduces a token-type input variable, which enables the use of GITHUB_TOKEN instead of a personal access token - by @Injabie3 in #70

New Contributors

• @Injabie3 made their first contribution in #70

Full Changelog: v2...v2.2.0

v2.1.3

What's Changed

• docs: cron schedule and comment in the example don't match by @ccatterina in #69
• Make behaviour of keep_at_least parameter predictable by @yma-het in #68

New Contributors

• @ccatterina made their first contribution in #69
• @yma-het made their first contribution in #68

Full Changelog: v2...v2.1.3

v2.1.2

What's Changed

• Fix unhandled exception raised at runtime: 'x-ratelimit-remaining' by @den-is in #58

New Contributors

• @den-is made their first contribution in #58

Full Changelog: v2...v2.1.2

v2.1.1

What's Changed

• Fix dry-run with filter by @chris-schra in #65

New Contributors

• @chris-schra made their first contribution in #65

Full Changelog: v2...v2.1.1

v2.1.0

What's new

• Add a dry-run flag by @jmichalicek in #62

New Contributors

• @jmichalicek made their first contribution in #62

Full Changelog: v2...v2.1.0

v2.0.1

What's Changed

• Mitigate shell injection attack by @ad-m-ss in #60

New Contributors

• @ad-m-ss made their first contribution in #60

Full Changelog: v2...v2.0.1

v2.0.0

What's Changed

• Rewrite to composite action by @lukasz-mitka in #36
• Fix example in README by @charyeezy in #45
• Update set-output syntax by @sondrelg in #49
• Upgrade Python version by @sondrelg in #54
• Follow pagination and implement rate throttling by @systemist in #42
• Generate encoded package name instead of storing it by @sondrelg in #55
• Limit number of versions to keep only after filtering by @artazar in #48
• Fix set-output syntax by @lukasz-mitka in #56

The two major changes in this release is that we now support deleting over 100 packages, as we will traverse the paginated API results. The second being that we've switched the action from running in a container, to running as a composite action. Neither change should break normal workflows.

New Contributors

• @charyeezy made their first contribution in #45
• @systemist made their first contribution in #42
• @artazar made their first contribution in #48

Full Changelog: v1...v2.0.0

v1.5.1

Changes

• Increased the number of packages fetched from 30 to 100 (#44)