feat: add GHCR cleanup job for old container images

- Add cleanup-old-images job that runs after build and security scan
- Enable cleanup on scheduled runs (weekly vulnerability scans)
- Delete all untagged image versions (keep-n-untagged: 0)
- Keep 10 most recent tagged versions for rollback
- Protect production tags: base-ubuntu, node, python
- Clean up ghost/partial multi-arch and orphaned images
- Only runs on main branch with continue-on-error for safety

Author: jmcombs

.github/workflows/build-and-publish.yml

@@ -64,6 +64,7 @@ jobs:
       - name: Install Devcontainer CLI
         run: npm install -g @devcontainers/cli
 
+      # Step 1: Build and publish base-ubuntu container first
       - name: Build and publish base-ubuntu container
         run: |
           cd src/base-ubuntu
@@ -73,6 +74,26 @@ jobs:
             --output type=registry \
             ${{ env.LABEL_ARGS }}
 
+      # Step 2: Extract the digest of the freshly built base-ubuntu image
+      - name: Get base-ubuntu image digest
+        id: base-digest
+        run: |
+          # Get the digest of the multi-platform manifest from the registry
+          DIGEST=$(docker buildx imagetools inspect ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:base-ubuntu --format '{{json .Manifest.Digest}}' | tr -d '"')
+          echo "digest=$DIGEST" >> $GITHUB_OUTPUT
+          echo "full_ref=${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${DIGEST}" >> $GITHUB_OUTPUT
+          echo "::notice::Base image digest: $DIGEST"
+
+      # Step 3: Update node devcontainer.json to use the exact base-ubuntu digest
+      - name: Update node devcontainer.json with base image digest
+        run: |
+          BASE_IMAGE="${{ steps.base-digest.outputs.full_ref }}"
+          echo "Updating node base image to: $BASE_IMAGE"
+          jq --arg img "$BASE_IMAGE" '.image = $img' src/node/.devcontainer/devcontainer.json > tmp.json
+          mv tmp.json src/node/.devcontainer/devcontainer.json
+          cat src/node/.devcontainer/devcontainer.json
+
+      # Step 4: Build and publish node container using the pinned base image
       - name: Build and publish node container
         run: |
           cd src/node
@@ -82,6 +103,16 @@ jobs:
             --output type=registry \
             ${{ env.LABEL_ARGS }}
 
+      # Step 5: Update python devcontainer.json to use the exact base-ubuntu digest
+      - name: Update python devcontainer.json with base image digest
+        run: |
+          BASE_IMAGE="${{ steps.base-digest.outputs.full_ref }}"
+          echo "Updating python base image to: $BASE_IMAGE"
+          jq --arg img "$BASE_IMAGE" '.image = $img' src/python/.devcontainer/devcontainer.json > tmp.json
+          mv tmp.json src/python/.devcontainer/devcontainer.json
+          cat src/python/.devcontainer/devcontainer.json
+
+      # Step 6: Build and publish python container using the pinned base image
       - name: Build and publish python container
         run: |
           cd src/python
@@ -118,7 +149,7 @@ jobs:
         run: docker pull ghcr.io/${{ github.repository }}:${{ matrix.image }}
 
       - name: Generate SBOM with Trivy
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.31.0
         with:
           image-ref: "ghcr.io/${{ github.repository }}:${{ matrix.image }}"
           format: "cyclonedx"
@@ -132,15 +163,70 @@ jobs:
           retention-days: 90
 
       - name: Scan for vulnerabilities with Trivy
-        uses: aquasecurity/trivy-action@master
+        uses: aquasecurity/trivy-action@0.31.0
         with:
           image-ref: "ghcr.io/${{ github.repository }}:${{ matrix.image }}"
           format: "sarif"
           output: "trivy-${{ matrix.image }}.sarif"
           severity: "CRITICAL,HIGH,MEDIUM"
 
       - name: Upload Trivy scan results to GitHub Security tab
-        uses: github/codeql-action/upload-sarif@v3
+        uses: github/codeql-action/upload-sarif@v4
         with:
           sarif_file: "trivy-${{ matrix.image }}.sarif"
           category: "container-${{ matrix.image }}"
+
+  # Cleanup old container images from GHCR
+  cleanup-old-images:
+    needs: [build-and-publish, security-scan]
+    runs-on: ubuntu-latest
+    # Only run on main branch to prevent accidental deletions from PR builds
+    # Runs on push, schedule (weekly scans), and manual dispatch
+    if: github.ref == 'refs/heads/main'
+    permissions:
+      packages: write
+    # Don't fail the workflow if cleanup fails
+    continue-on-error: true
+
+    steps:
+      - name: Log cleanup start
+        run: |
+          echo "=== GHCR Cleanup Job ==="
+          echo "Package: ghcr.io/${{ github.repository }}"
+          echo "Trigger: ${{ github.event_name }}"
+          echo ""
+          echo "Retention Policy:"
+          echo "  - Keep current tags: base-ubuntu, node, python"
+          echo "  - Keep 10 most recent tagged versions"
+          echo "  - Delete ALL untagged versions"
+          echo "  - Delete ghost/partial multi-arch images"
+          echo "  - Delete orphaned referrer images"
+          echo ""
+
+      # Single cleanup step for the devcontainer package
+      # All image variants (base-ubuntu, node, python) are tags within this single package
+      - name: Cleanup old container image versions
+        uses: dataaxiom/ghcr-cleanup-action@v1
+        with:
+          token: ${{ secrets.GITHUB_TOKEN }}
+          package: devcontainer
+          owner: ${{ github.repository_owner }}
+          # Delete all untagged images - we use specific tags for production
+          delete-untagged: true
+          keep-n-untagged: 0
+          # Keep recent tagged versions for rollback capability
+          keep-n-tagged: 10
+          # Protect the current production tags from deletion
+          exclude-tags: base-ubuntu,node,python
+          # Clean up corrupted multi-architecture images
+          delete-ghost-images: true
+          delete-partial-images: true
+          # Clean up orphaned attestation/referrer images
+          delete-orphaned-images: true
+          # Set to true for testing, false for actual cleanup
+          dry-run: false
+
+      - name: Log cleanup complete
+        run: |
+          echo "=== Cleanup Complete ==="
+          echo "View packages: https://github.com/${{ github.repository_owner }}?tab=packages&repo_name=devcontainer"

README.md

@@ -9,10 +9,10 @@
 
 This repository implements automated security scanning for all container images:
 
-- 🔍 **Vulnerability Scanning**: All images are scanned with [Trivy](https://trivy.dev/) for CVEs
-- 📋 **SBOM Generation**: Software Bill of Materials generated in CycloneDX format
-- 🔄 **Scheduled Scans**: Weekly security scans catch newly discovered vulnerabilities
-- 📊 **Security Dashboard**: View results in the [Security tab](https://github.com/jmcombs/devcontainer/security/code-scanning)
+- **Vulnerability Scanning**: All images are scanned with [Trivy](https://trivy.dev/) for CVEs
+- **SBOM Generation**: Software Bill of Materials generated in CycloneDX format
+- **Scheduled Scans**: Weekly security scans catch newly discovered vulnerabilities
+- **Security Dashboard**: View results in the [Security tab](https://github.com/jmcombs/devcontainer/security/code-scanning)
 
 A collection of [Development Container](https://containers.dev/) definitions for creating consistent, reproducible development environments. This repository provides pre-configured `devcontainer` images to streamline setting up development environments in tools like Visual Studio Code, GitHub Codespaces, or other container-based IDEs.
 

src/node/.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "docker.io/jmcombs/devcontainer:base-ubuntu",
+  "image": "ghcr.io/jmcombs/devcontainer:base-ubuntu",
   "features": {
     "ghcr.io/devcontainers/features/node:1": {},
     "ghcr.io/jmcombs/devcontainer-features/ngrok:1": {}

src/python/.devcontainer/devcontainer.json

@@ -1,5 +1,5 @@
 {
-  "image": "docker.io/jmcombs/devcontainer:base-ubuntu",
+  "image": "ghcr.io/jmcombs/devcontainer:base-ubuntu",
   "features": {
     "ghcr.io/devcontainers/features/python:1": {},
     "ghcr.io/jmcombs/devcontainer-features/ngrok:1": {}