Update CI workflows for reliable generation and GHCR cleanup

Author: GitHub Copilot

.github/workflows/action-docker-publish.yml

@@ -4,17 +4,23 @@ on:
   push:
     paths:
       - "generate-dockerfiles.sh"
-      - "generate-docker-compose.yml"
+      - "generate-docker-compose.sh"
       - "requirements.txt"
       - "Dockerfile.j2"
       - "docker-compose.yml.j2"
   schedule:
     - cron: "0 3 * * 6"
 
+concurrency:
+  group: docker-publish-${{ github.ref }}
+  cancel-in-progress: false
+
 jobs:
   generate-dockerfiles:
     name: Generate Dockerfiles
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     outputs:
       matrix: ${{ steps.set-matrix.outputs.matrix }}
     steps:
@@ -24,25 +30,34 @@ jobs:
       - name: Generate python
         uses: actions/setup-python@v6
         with:
+          python-version: "3.12"
           cache: "pip"
+          cache-dependency-path: requirements.txt
       - run: pip3 install -r requirements.txt
 
       - name: Generate Dockerfile with generate-dockerfiles.sh
         run: ./generate-dockerfiles.sh
 
       - name: Upload a Build Artifact
-        uses: actions/upload-artifact@v5.0.0
+        uses: actions/upload-artifact@v7
         with:
           # Artifact name
           name: Dockerfiles
           # A file, directory or wildcard pattern that describes what to upload
           path: dockerfiles
 
-      - name: Push commit
-        uses: EndBug/add-and-commit@v9
-        with:
-          message: "Generate Dockerfiles"
-          add: "dockerfiles/Dockerfile*"
+      - name: Commit and push generated Dockerfiles
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add dockerfiles/Dockerfile*
+          if git diff --cached --quiet; then
+            echo "No Dockerfile changes to commit"
+            exit 0
+          fi
+          git commit -m "Generate Dockerfiles"
+          git pull --rebase origin "${GITHUB_REF_NAME}"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
 
       - id: set-matrix
         run: |
@@ -53,24 +68,36 @@ jobs:
   generate-docker-compose:
     name: Generate docker-compose.yml files
     runs-on: ubuntu-latest
+    needs: generate-dockerfiles
+    permissions:
+      contents: write
     steps:
       - name: Checkout
         uses: actions/checkout@v5
 
       - name: Setup python
         uses: actions/setup-python@v6
         with:
+          python-version: "3.12"
           cache: "pip"
+          cache-dependency-path: requirements.txt
       - run: pip3 install -r requirements.txt
 
       - name: Generate docker-compose.yml files with generate-docker-compose.sh
         run: ./generate-docker-compose.sh
 
-      - name: Push commit
-        uses: EndBug/add-and-commit@v9
-        with:
-          message: "Generate docker-compose.yml files"
-          add: "docker-compose/docker-compose*"
+      - name: Commit and push generated docker-compose files
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add docker-compose/docker-compose*
+          if git diff --cached --quiet; then
+            echo "No docker-compose changes to commit"
+            exit 0
+          fi
+          git commit -m "Generate docker-compose.yml files"
+          git pull --rebase origin "${GITHUB_REF_NAME}"
+          git push origin "HEAD:${GITHUB_REF_NAME}"
 
   docker-publish:
     name: Publish Docker Images
@@ -145,37 +172,55 @@ jobs:
   package-cleanup:
     name: Cleanup Old GitHub Packages
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true
 
   package-cleanup-2:
     name: Cleanup Old GitHub Packages 2
     needs: package-cleanup
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true
 
   package-cleanup-3:
     name: Cleanup Old GitHub Packages 3
     needs: package-cleanup-2
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true

.github/workflows/action-package-cleanup.yml

@@ -13,36 +13,45 @@ jobs:
     name: Cleanup Old GitHub Packages
     runs-on: ubuntu-latest
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true
 
   package-cleanup-2:
     name: Cleanup Old GitHub Packages 2
     needs: package-cleanup
     runs-on: ubuntu-latest
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true
 
   package-cleanup-3:
     name: Cleanup Old GitHub Packages 3
     needs: package-cleanup-2
     runs-on: ubuntu-latest
     steps:
-      - name: Delete Package Versions
-        uses: actions/delete-package-versions@v5
+      - name: Delete old untagged package versions
+        uses: snok/container-retention-policy@v3.0.1
         with:
-          package-name: gameserver
-          package-type: container
-          min-versions-to-keep: 1
-          delete-only-untagged-versions: true
+          account: GameServerManagers
+          token: ${{ secrets.GITHUB_TOKEN }}
+          image-names: gameserver
+          tag-selection: untagged
+          keep-n-most-recent: 1
+          cut-off: 1s
+          dry-run: true