From e4200e17ec077c2fa02317b08dc3f4bef5855e79 Mon Sep 17 00:00:00 2001
From: Miguel Angel Ajo Pelayo <miguelangel@ajo.es>
Date: Tue, 27 Jan 2026 17:03:40 +0100
Subject: [PATCH 1/2] ci: build expirable images for pull-requests

---
 .github/workflows/build-images.yaml | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index 7dd9b3614..065dfa001 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -8,10 +8,14 @@ on:
     branches:
       - main
       - 'release-*'
+  pull_request:
+    branches:
+      - main
+      - 'release-*'
   merge_group:
 
 env:
-  PUSH: ${{ github.repository_owner == 'jumpstarter-dev' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/release-')) }}
+  PUSH: ${{ github.repository_owner == 'jumpstarter-dev' && (github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/release-') || (github.event_name == 'pull_request' && github.event.pull_request.head.repo.full_name == github.repository)) }}
   REGISTRY: quay.io
   QUAY_ORG: quay.io/jumpstarter-dev
 
@@ -119,6 +123,10 @@ jobs:
         uses: docker/metadata-action@v5
         with:
           images: ${{ env.REGISTRY }}/${{ matrix.image_name }}
+          tags: |
+            type=ref,event=pr,prefix=pr-
+          labels: |
+            quay.expires-after=${{ github.event_name == 'pull_request' && '7d' || '' }}
 
       - name: Build and push Docker image
         id: push
@@ -127,7 +135,7 @@ jobs:
           context: ${{ matrix.context }}
           file: ${{ matrix.dockerfile }}
           push: ${{ env.PUSH }}
-          tags: ${{ steps.set-tags.outputs.tags }}
+          tags: ${{ github.event_name == 'pull_request' && steps.meta.outputs.tags || steps.set-tags.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=gha

From f6fa7a0f295561abe61d7df6b81b551c7a0058ef Mon Sep 17 00:00:00 2001
From: Miguel Angel Ajo Pelayo <miguelangel@ajo.es>
Date: Fri, 30 Jan 2026 16:03:33 +0100
Subject: [PATCH 2/2] ci: build only on build-pr-images label

---
 .github/workflows/build-images.yaml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/build-images.yaml b/.github/workflows/build-images.yaml
index 065dfa001..59d807676 100644
--- a/.github/workflows/build-images.yaml
+++ b/.github/workflows/build-images.yaml
@@ -9,6 +9,7 @@ on:
       - main
       - 'release-*'
   pull_request:
+    types: [opened, synchronize, reopened, labeled]
     branches:
       - main
       - 'release-*'
@@ -21,6 +22,7 @@ env:
 
 jobs:
   build-and-push-image:
+    if: github.event_name != 'pull_request' || contains(github.event.pull_request.labels.*.name, 'build-pr-images')
     runs-on: ubuntu-latest
     permissions:
       contents: read