withdraw-images.yaml

on:
  workflow_dispatch:
    inputs:
      dry_run:
        type: boolean
        default: 'true'
        description: If true, just log

permissions:
  contents: read

jobs:
  withdraw:
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
        with:
          egress-policy: audit

      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4
      - uses: chainguard-dev/setup-chainctl@598499528905f95b94e62e4831cf42035e768933 # v0.2.3
        with:
          identity: 720909c9f5279097d847ad02a2f24ba8f59de36a/b6461e99e132298f
      - uses: imjasonh/setup-crane@31b88efe9de28ae0ffa220711af4b60be9435f6e # v0.4
      - run: |
          for img in $(grep -v '\#' withdrawn-images.txt); do
            if [[ "${{ github.event.inputs.dry_run }}" == "false" ]]; then
              crane delete "$img" || true
              crane delete "$img-dev" || true
            else
              echo "DRY RUN: crane delete $img || true"
              echo "DRY RUN: crane delete $img-dev || true"
            fi
          done