Make ghcr.io cleanup more robust

We need to ensure that we don't accidentally delete not-yet-tagged
images created by other PR's jobs. Additionally, we enable
`delete-untagged` for the job that deletes the PR tag after the PR gets
closed.

Author: simu

.github/workflows/cleanup-pr-tag.yml

@@ -19,3 +19,9 @@ jobs:
           tags: ${{ env.VERSION }}
           package: ${{ github.event.repository.name }}
           token: ${{ secrets.GITHUB_TOKEN }}
+          # NOTE(sg): When we delete a tag, we need to explicitly enable
+          # `delete-untagged` to also cleanup the now untagged images.  Here,
+          # we probably don't need to have an age guard, since this action
+          # will almost certainly always run before other (renovate) PRs are
+          # updated to the latest master branch.
+          delete-untagged: true

.github/workflows/container-image.yml

@@ -244,6 +244,9 @@ jobs:
       with:
         token: ${{ secrets.GITHUB_TOKEN }}
         package: ${{ github.event.repository.name }}
+        # NOTE(sg): Only delete untagged images older than 5 minutes, so that
+        # we don't delete not-yet-tagged images generated by other PR's jobs.
+        older-than: 5 minutes
         validate: true
 
   release: