Split CI and image cleanup

.github/workflows/ci.yml

@@ -6,7 +6,6 @@ on:
       - opened
       - synchronize
       - reopened
-      - closed
   push:
     branches:
       - main
@@ -24,7 +23,6 @@ env:
 
 jobs:
   validate-cockpit:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -45,7 +43,6 @@ jobs:
         run: pnpm nx run-many --projects=cockpit -t lint typecheck test
 
   validate-backend:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -70,7 +67,6 @@ jobs:
         run: pnpm nx run-many --projects=backend -t lint typecheck test
 
   validate-i12e:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -94,7 +90,6 @@ jobs:
         run: docker compose --env-file i12e/orchestrator/deploy/.env.prod.example --file i12e/orchestrator/deploy/docker-compose.prod.yml config --quiet
 
   validate-release-ref:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v5
@@ -108,7 +103,6 @@ jobs:
           git merge-base --is-ancestor "$GITHUB_SHA" origin/main
 
   build-image-cockpit:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     needs:
       - validate-release-ref
@@ -142,7 +136,6 @@ jobs:
           docker push "$image"
 
   build-image-backend:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     needs:
       - validate-release-ref
@@ -176,7 +169,6 @@ jobs:
           docker push "$image"
 
   build-images-i12e:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     needs:
       - validate-release-ref
@@ -213,7 +205,6 @@ jobs:
           docker push "$gateway_image"
 
   test-images-integration:
-    if: ${{ !(github.event_name == 'pull_request' && github.event.action == 'closed') }}
     runs-on: ubuntu-latest
     needs:
       - build-image-cockpit
@@ -335,59 +326,6 @@ jobs:
           publish_image i12e-postgres
           publish_image i12e-gateway
 
-  cleanup-pr-images:
-    runs-on: ubuntu-latest
-    if: github.event_name == 'pull_request' && github.event.action == 'closed'
-    steps:
-      - name: Delete closed PR images
-        uses: actions/github-script@v8
-        with:
-          script: |
-            const owner = context.repo.owner;
-            const ownerType = context.payload.repository.owner.type;
-            const packageNames = [
-              'central/app-cockpit',
-              'central/service-backend',
-              'central/i12e-postgres',
-              'central/i12e-gateway',
-            ];
-            const prTagPrefix = `pr-${context.payload.pull_request.number}-`;
-
-            for (const packageName of packageNames) {
-              const listRoute =
-                ownerType === 'Organization'
-                  ? 'GET /orgs/{org}/packages/{package_type}/{package_name}/versions'
-                  : 'GET /user/packages/{package_type}/{package_name}/versions';
-              const deleteRoute =
-                ownerType === 'Organization'
-                  ? 'DELETE /orgs/{org}/packages/{package_type}/{package_name}/versions/{package_version_id}'
-                  : 'DELETE /user/packages/{package_type}/{package_name}/versions/{package_version_id}';
-              const packageOwner = ownerType === 'Organization' ? { org: owner } : {};
-
-              for await (const versions of github.paginate.iterator(listRoute, {
-                ...packageOwner,
-                package_type: 'container',
-                package_name: packageName,
-                per_page: 100,
-              })) {
-                for (const version of versions.data) {
-                  const tags = version.metadata?.container?.tags ?? [];
-                  const hasClosedPrTag = tags.some((tag) => tag.startsWith(prTagPrefix));
-
-                  if (!hasClosedPrTag) {
-                    continue;
-                  }
-
-                  await github.request(deleteRoute, {
-                    ...packageOwner,
-                    package_type: 'container',
-                    package_name: packageName,
-                    package_version_id: version.id,
-                  });
-                }
-              }
-            }
-
   package-deploy-bundle:
     runs-on: ubuntu-latest
     if: startsWith(github.ref, 'refs/tags/')

.github/workflows/cleanup-pr-images.yml

@@ -0,0 +1,62 @@
+name: Cleanup PR Images
+
+on:
+  pull_request:
+    types:
+      - closed
+
+permissions:
+  packages: write
+
+jobs:
+  cleanup-pr-images:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete closed PR images
+        uses: actions/github-script@v8
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const ownerType = context.payload.repository.owner.type;
+            const packageNames = [
+              'central/app-cockpit',
+              'central/service-backend',
+              'central/i12e-postgres',
+              'central/i12e-gateway',
+            ];
+            const prTagPrefix = `pr-${context.payload.pull_request.number}-`;
+
+            for (const packageName of packageNames) {
+              const listRoute =
+                ownerType === 'Organization'
+                  ? 'GET /orgs/{org}/packages/{package_type}/{package_name}/versions'
+                  : 'GET /user/packages/{package_type}/{package_name}/versions';
+              const deleteRoute =
+                ownerType === 'Organization'
+                  ? 'DELETE /orgs/{org}/packages/{package_type}/{package_name}/versions/{package_version_id}'
+                  : 'DELETE /user/packages/{package_type}/{package_name}/versions/{package_version_id}';
+              const packageOwner = ownerType === 'Organization' ? { org: owner } : {};
+
+              for await (const versions of github.paginate.iterator(listRoute, {
+                ...packageOwner,
+                package_type: 'container',
+                package_name: packageName,
+                per_page: 100,
+              })) {
+                for (const version of versions.data) {
+                  const tags = version.metadata?.container?.tags ?? [];
+                  const hasClosedPrTag = tags.some((tag) => tag.startsWith(prTagPrefix));
+
+                  if (!hasClosedPrTag) {
+                    continue;
+                  }
+
+                  await github.request(deleteRoute, {
+                    ...packageOwner,
+                    package_type: 'container',
+                    package_name: packageName,
+                    package_version_id: version.id,
+                  });
+                }
+              }
+            }