FelixYBW opened a new pull request, #13426: URL: https://github.com/apache/gluten/pull/13426
## What changes are proposed in this pull request? Part of #12288. https://hub.docker.com/r/apache/gluten has 36 tags, and many of them are no longer built or used. Only the Docker Hub credentials in the repository secrets (`DOCKERHUB_USER` / `DOCKERHUB_TOKEN`) can delete tags, and pull-request workflows don't get secrets. So this adds `.github/workflows/docker_hub_cleanup.yml`, a `workflow_dispatch` workflow that a committer runs from the Actions tab after merge. **Inputs** - `tags`: space-separated tags to delete. - `dry_run`: defaults to **true**, in which case the workflow only checks and lists the tags. **Safety checks.** A tag is refused, and the run fails before deleting anything, if: - it is a release tag (`<major>.<minor>-*`, e.g. `1.5-centos-8-jdk8`); - `docker_image.yml` still publishes it, since the weekly build would recreate it; - `apache/gluten:<tag>` appears anywhere on `main` or on any `branch-*` release branch (workflows, docs, scripts); - it doesn't exist on Docker Hub. **Deletion** uses the Docker Hub API: `POST /v2/auth/token`, then `DELETE /v2/namespaces/apache/repositories/gluten/tags/<tag>`. A `403` is reported as "the token needs delete access (ask ASF Infra)". **Default tag list.** These 6 tags are referenced nowhere and are no longer built: `centos-8-dev`, `gluten-vcpkg-builder_2024_03_17`, `gluten-vcpkg-builder_2024_05_22`, `gluten-vcpkg-builder_2024_07_10`, `gluten-vcpkg-builder_2024_07_11`, `gluten-vcpkg-builder_2024_08_05` After #13422 merges and stops publishing them, these 3 also pass the checks and can be deleted in a second run: `centos-9-jdk11`, `centos-9-jdk17-cuda12.9-cudf`, `ubuntu22-m2-cache`. **Not deleted, because release branches still use them:** | Tag | Used by | |---|---| | `gluten-vcpkg-builder_2024_05_29` | `branch-1.2` | | `vcpkg-centos-7` | `branch-1.2` to `branch-1.6`, including the 1.6 release build | | `vcpkg-centos-7-gcc13` | `branch-1.7` release build | | `vcpkg-centos-8` | `branch-1.5`, `branch-1.6` | | `centos-9-jdk8-cudf` | `branch-1.5` to `branch-1.7` | | `centos-8` | `branch-1.3` | The workflow refuses these tags on its own. ## How was this patch tested? - `actionlint`: clean. License header check: clean. - I ran the safety-check step locally against all branches. It accepted the 6 default tags and refused each of these for the right reason: `gluten-vcpkg-builder_2024_05_29`, `vcpkg-centos-7`, `vcpkg-centos-7-gcc13` and `centos-8` (referenced on a release branch), `1.5-vcpkg-centos-8` and `1.4-centos-8-jdk11` (release tags), `centos-8-jdk8` (still published), a missing tag, and an invalid name. - Against #13422's `docker_image.yml` it accepts `centos-9-jdk11`, `centos-9-jdk17-cuda12.9-cudf` and `ubuntu22-m2-cache`. - The Docker Hub endpoints answer as expected without credentials (`401` for delete, `400` for a malformed login). - I couldn't test the actual delete, because it needs the repository's Docker Hub token. Whether that token has delete scope is unknown. If the run reports `403`, the tags have to be deleted by ASF Infra (INFRA Jira) instead. ## Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude claude-opus-5-5 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
