name: Cleanup dangling container images

on:
  workflow_dispatch:
    inputs:
      dry_run:
        description: "Preview only (do not delete image versions)"
        type: boolean
        default: false

# Share this lock with publishing and the other cleanup workflow.
concurrency:
  group: ghcr-images
  cancel-in-progress: false

jobs:
  cleanup:
    runs-on: ubuntu-latest
    timeout-minutes: 120
    permissions:
      packages: write
    steps:
      # Untagged architecture manifests can still belong to a tagged image.
      - name: Delete untagged and unreferenced versions
        uses: dataaxiom/ghcr-cleanup-action@d52806a0dc70b430571a37da1fde39733ffd640f # v1.2.2
        with:
          delete-untagged: true
          dry-run: ${{ inputs.dry_run }}