From 8b0f8fe7a3be6186713576b5025a516b416ced96 Mon Sep 17 00:00:00 2001
From: clsferguson <48876201+clsferguson@users.noreply.github.com>
Date: Tue, 9 Sep 2025 22:58:20 -0600
Subject: [PATCH] Add workflow for cleaning up untagged GHCR images

---
 .github/workflows/cleanup-ghcr-untagged.yml | 44 +++++++++++++++++++++
 1 file changed, 44 insertions(+)
 create mode 100644 .github/workflows/cleanup-ghcr-untagged.yml

diff --git a/.github/workflows/cleanup-ghcr-untagged.yml b/.github/workflows/cleanup-ghcr-untagged.yml
new file mode 100644
index 000000000..366bb16d4
--- /dev/null
+++ b/.github/workflows/cleanup-ghcr-untagged.yml
@@ -0,0 +1,44 @@
+name: Cleanup GHCR Untagged (deferred/manual)
+
+on:
+  workflow_run:
+    workflows: ["Sync Fork and Build Docker Image on Upstream Release"]
+    types: [completed]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+  packages: write
+
+jobs:
+  deferred-cleanup:
+    # only run automatically if the upstream workflow finished successfully
+    if: ${{ github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Wait 60 minutes (allow registry to settle)
+        if: ${{ github.event_name != 'workflow_dispatch' }}
+        run: sleep 3600
+        shell: bash
+
+      - name: Select cleanup token
+        id: token
+        shell: bash
+        run: |
+          if [ -n "${{ secrets.CR_PAT }}" ]; then
+            echo "token=${{ secrets.CR_PAT }}" >> "$GITHUB_OUTPUT"
+          else
+            echo "token=${{ secrets.GITHUB_TOKEN }}" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: Prune untagged GHCR versions (multi-arch safe)
+        uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          token: ${{ steps.token.outputs.token }}
+          owner: ${{ github.repository_owner }}
+          repository: ${{ github.event.repository.name }}
+          package: comfyui-docker
+          delete-untagged: true
+          older-than: '15 minutes'
+          delete-partial-images: true
+          dry-run: false