From 24da04fecefcfe4c919c1c1f596631355a89fadf Mon Sep 17 00:00:00 2001
From: Dany Khalife <dev@dkhalife.com>
Date: Sun, 24 May 2026 14:22:22 -0700
Subject: [PATCH] Clean up old ACR images during release

Add a cleanup step after the API and MCP image pushes in the canary release job. Deletes manifests older than 3 days for both task-wizard-api and task-wizard-mcp, preserving any tagged 'canary' or 'release'.
---
 .github/workflows/full-release.yml | 20 ++++++++++++++++++++
 1 file changed, 20 insertions(+)

diff --git a/.github/workflows/full-release.yml b/.github/workflows/full-release.yml
index ced82b3..17eae88 100644
--- a/.github/workflows/full-release.yml
+++ b/.github/workflows/full-release.yml
@@ -152,6 +152,26 @@ jobs:
           tags: ${{ secrets.ACR_NAME }}.azurecr.io/task-wizard-mcp:canary, ${{ secrets.ACR_NAME }}.azurecr.io/task-wizard-mcp:${{ github.ref_name }}
           platforms: linux/amd64
 
+      - name: Cleanup old ACR images
+        run: |
+          CUTOFF_DATE=$(date -u -d '3 days ago' +%Y-%m-%dT%H:%M:%SZ)
+          echo "Cleaning up images older than $CUTOFF_DATE"
+
+          for REPO in task-wizard-api task-wizard-mcp; do
+            echo "Scanning $REPO"
+            az acr manifest list-metadata \
+              --registry ${{ secrets.ACR_NAME }} \
+              --name "$REPO" \
+              --query "[?lastUpdateTime<'$CUTOFF_DATE' && !contains(tags, 'canary') && !contains(tags, 'release')].digest" \
+              -o tsv | \
+            while read digest; do
+              if [ -n "$digest" ]; then
+                echo "Deleting $REPO@$digest"
+                az acr repository delete --name ${{ secrets.ACR_NAME }} --image "$REPO@$digest" --yes
+              fi
+            done
+          done
+
       - name: Set up JDK 21
         uses: actions/setup-java@v4
         with: