fix: clean registry buildcache tags on PR close

[Copilot]

Buildcache tags accumulate in container registries (ghcr.io and eicweb.phy.anl.gov) without timestamps for automatic eviction. This adds a workflow to delete them when PRs close or via manual trigger.

Implementation

• New workflow .github/workflows/cleanup-buildcache.yml triggers on:
  • pull_request: types[closed] - automatic cleanup when PR closes
  • workflow_dispatch - manual cleanup with branch slug input
• Slug Action Integration: Explicitly includes rlespinasse/github-slug-action@v5 (for pull_request events) to ensure GITHUB_REF_POINT_SLUG is set
• GitHub Container Registry: Uses GitHub Packages API to delete versions matching tag pattern -{GITHUB_REF_POINT_SLUG}-
• GitLab Container Registry: Uses GitLab API v4 to delete tags from project 290 (containers/eic_container)
• Tag pattern: Matches all buildcache variants using GITHUB_REF_POINT_SLUG (derived from branch name):
  • Base images: {BUILD_IMAGE}-{GITHUB_REF_POINT_SLUG}-{arch}
  • EIC images: {BUILD_IMAGE}{ENV}-{BUILD_TYPE}-{GITHUB_REF_POINT_SLUG}-{arch}

Example

For a PR from branch "my-feature" (where GITHUB_REF_POINT_SLUG = "my-feature"), deletes:

debian_stable_base-my-feature-amd64
debian_stable_base-my-feature-amd64_v3
debian_stable_base-my-feature-arm64
cuda_devel-my-feature-amd64
eic_ci-default-my-feature-amd64
eic_ci-default-my-feature-amd64_v3
eic_xl-default-my-feature-arm64
...

For manual cleanup via workflow_dispatch, provide the branch slug (e.g., "old-feature") as input to delete buildcache tags for that branch.

The cleanup workflow uses the same GITHUB_REF_POINT_SLUG variable as the build-push workflow, ensuring pattern consistency between tag creation and deletion.

Authentication uses existing secrets: GHCR_REGISTRY_TOKEN and GITLAB_TOKEN

Documentation

Updated docs/build-pipeline.md to document cleanup workflow and caching strategy.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Clean registry buildcache when PR merged or closed</issue_title>
<issue_description>Is your feature request related to a problem? Please describe.
We write the buildcache for pull requests to the registry as tags for the buildcache image at https://eicweb.phy.anl.gov/containers/eic_container/container_registry/143. This accumulates without a clear way to clean up since the buildcache tags don't have a timestamp set that could be used for automatic eviction. This also affects ghcr.io.

Describe the solution you'd like
When a pull request is merged, we should explicitly remove the buildcache tags from the registries (both eicweb and ghcr.io).

Describe alternatives you've considered
An alternative approach is to have a periodic scheduled workflow that removes the buildcache entries that do not have a corresponding open pull request.</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes Clean registry buildcache when PR merged or closed #89

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull request overview

This PR implements automatic cleanup of buildcache container image tags from both ghcr.io and eicweb.phy.anl.gov registries when pull requests are closed or merged. This addresses the issue of buildcache accumulation without timestamps for automatic eviction. The workflow uses the branch slug (GITHUB_REF_POINT_SLUG) to identify and remove all associated buildcache tags.

Key Changes

• Added new .github/workflows/cleanup-buildcache.yml workflow triggered on PR close
• Implements deletion logic for both GitHub Container Registry (ghcr.io) and GitLab Container Registry (eicweb.phy.anl.gov)
• Updated build pipeline documentation to describe the automatic cleanup behavior

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
.github/workflows/cleanup-buildcache.yml	New workflow that cleans up buildcache tags using branch slug pattern matching from both registries when PRs are closed, with manual dispatch option
docs/build-pipeline.md	Documents the buildcache cleanup workflow behavior and adds new trigger table section

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.