clean-cache-registry.yml

name: Clean old cache in App registries

on:
  workflow_dispatch:
  schedule:
    - cron: '0 0 * * *' # Daily

permissions:
  id-token: write
  contents: read

jobs:
  purge:
    runs-on: ubuntu-latest
    strategy:
      fail-fast: false
      matrix:
        target:
          - name: "dev"
            registry: "radixdevapp"
          - name: "playground"
            registry: "radixplaygroundapp"
          - name: "platform"
            registry: "radixprodapp"
          - name: "c2"
            registry: "radixc2app"
    environment: ${{matrix.target.name }}

    steps:
      - uses: actions/checkout@v4
        with:
          repository: Azure/acr-cli
          ref: v0.8

      - uses: actions/setup-go@v5

      - name: Compile ACR binary
        run: make binaries

      - name: Get GitHub Public IP
        id: github_public_ip
        run: echo "ipv4=$(curl 'https://ifconfig.me/ip')" >> $GITHUB_OUTPUT

      - name: 'Az CLI login'
        uses: azure/login@v2
        with:
          client-id: ${{ vars.AZURE_CLIENT_ID }}
          tenant-id: ${{ vars.AZURE_TENANT_ID }}
          subscription-id: ${{ vars.AZURE_SUBSCRIPTION_ID }}

      - name: Enable Public Access to ACR
        id: enable_publicaccess
        run: az acr update --name ${{ matrix.target.registry }} --public-network-enabled true --query provisioningState

      - name: Add GitHub IP to ACR
        id: update_firewall
        run: az acr network-rule add --name ${{ matrix.target.registry }} --ip-address  ${{ steps.github_public_ip.outputs.ipv4 }} --query provisioningState

      - name: Create ACR Token
        run: echo "token=$(az acr login --name=${{ matrix.target.registry }} --expose-token | jq -r '.accessToken')" >> $GITHUB_OUTPUT
        id: token

      - name: Purge old cache
        run: ./bin/acr purge --registry=${{ matrix.target.registry }}.azurecr.io --password=${{steps.token.outputs.token}} --username= --filter='*/cache:.*' --ago=7d --untagged

      - name: Revoke GitHub IP on ACR
        if: ${{ steps.update_firewall.outcome == 'success' && !cancelled()}} # Always run this step even if previous step failed
        run: az acr network-rule remove --name ${{ matrix.target.registry }} --ip-address  ${{ steps.github_public_ip.outputs.ipv4 }} --query provisioningState

      - name: Disable Public Access to ACR
        id: disable_publicaccess
        if: ${{ steps.enable_publicaccess.outcome == 'success' && !cancelled()}} # Always run this step even if previous step failed
        run: az acr update --name ${{ matrix.target.registry }} --public-network-enabled false --query provisioningState