Repository navigation
This is the first UnitVectorY-Labs downstream maintenance release of actions/delete-package-versions, based on the upstream 5.x input interface. The uvy.1 suffix distinguishes this fork revision without replacing upstream tags or starting an unrelated version series.
Automatic GHCR cleanup with delete-only-untagged-versions: true now preserves all manifests reachable from tagged images, including nested OCI/Docker indexes and index-attached Buildx provenance attestations. Existing retention applies to genuinely unreferenced versions. Incomplete discovery or changing tags stops deletion.
The action runs on Node.js 24. Fork CI uses current major-version action tags, and the checked-in bundle is rebuilt and verified. The review finding about metadata checks affecting other deletion modes is fixed and covered by regression tests.
Validation: 59 tests and all CI checks pass. On the real UnitVectorY-Labs/docker-llama.cpp-cuda package, cleanup deleted 6 unreferenced versions while protecting 14 live manifests. All four provenance attestations remained accessible and all six image tags pulled successfully on GX10 afterward. Full test evidence.
Reference protection currently covers automatic untagged container cleanup on GitHub.com GHCR. Explicit version IDs and other deletion modes retain their existing behavior; independent OCI referrers are outside this mode's scope. Serialize every publisher of a package with its cleanup. GHES fails closed in this mode.
The release points to the exact tested commit, which is included in merged PR #1:
uses: UnitVectorY-Labs/delete-package-versions@1ca5e6ebabb7169ddb0e0afc62403eec27832c31 # v5.0.1-uvy.1Upstream reports: actions/delete-package-versions#162, #90. Merged implementation.