mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 4.7
a26bfc4e94
Module moves (with imports, paths, argv literals, scripts, docs, and
parents[N] formulas updated in lockstep):
- cli/deploy -> cli/administration/deploy
- cli/validate/inventory -> cli/administration/inventory/validate
- cli/vault -> cli/administration/secrets/vault
- cli/administration/inventory/encrypt -> cli/administration/secrets/seal
- cli/mirror -> cli/contributing/mirror
The new cli/administration/secrets cluster collocates the whole-file
ansible-vault wrapper next to the inventory-aware per-field sealer.
The user-facing CLI subcommand paths follow the package layout, e.g.
"infinito administration deploy dedicated <inv>" and
"infinito administration inventory validate <inv>".
Help system redesign in cli/core/{discovery,help,app}.py:
- Discovery now distinguishes runnable commands (directories with
__main__.py) from category folders (directories that only group
further commands). Empty support packages are filtered out.
- Each category folder MAY carry a README.md; its H1 heading is used
as the title and its first paragraph as the one-line description in
the help output.
- "infinito" / "infinito --help" prints only the top-level entries
(one level deep). "infinito <category>" navigates into a folder and
shows its sub-folders and commands one level deep, with the README
title as the page heading and the invocation as a dim subtitle.
- New "--tree [N]" flag walks the tree under the (optional) path
prefix recursively. N caps the depth (1-based); omit N for an
unbounded walk. The output uses Unicode tree connectors, an emoji
per entry (folder for categories, gear for commands), a globally
aligned description column, and multi-line wrapped descriptions
with tree-continuity bars on continuation lines.
- Category and command listings use the full invocation
("infinito meta callorder") rather than the bare leaf name, so the
output is copy-pasteable.
Convention doc + 17 CLI READMEs:
- New docs/contributing/artefact/files/cli/readme_md.md describes the
H1+paragraph layout the help system reads, and how it differs from
role/docs READMEs.
- README.md added for cli/{administration, build, contributing, meta}
and their immediate sub-folders, plus cli/meta/roles/applications
and its resolution sub-folder. Each follows the "title with trailing
emoji + single descriptive paragraph" convention.
Mirror resolver/sync description strings (the help system reads them
from argparse --help output) added so they no longer surface as
"options:" in the global index. cli/mirror/cleanup already had a
description and is unchanged.
Fixes uncovered by the move:
- import unittest.mock added to four dedicated-deploy tests so
unittest.mock.patch resolves under stdlib unittest discovery
(Python 3.13 no longer surfaces unittest.mock through "import
unittest" alone).
- parents[N] index in the new
cli/administration/inventory/validate/__init__.py corrected from
3 to 4 to match the deeper layout.
- test_paths.INVENTORY_VALIDATOR_PATH assertion and test_runner
substring assertions updated to match the new validator path.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
76 lines
2.5 KiB
Markdown
76 lines
2.5 KiB
Markdown
# Mirror Cleanup: Deleting Private GHCR Packages 🗑️
|
|
|
|
The `cli.contributing.mirror.cleanup` module deletes GHCR container packages filtered by
|
|
prefix and visibility. Use it to remove stale private mirror packages that
|
|
were pushed before the repository switched to `GITHUB_TOKEN`-based
|
|
authentication (which now makes packages public automatically).
|
|
|
|
## Prerequisites 📋
|
|
|
|
You MUST have a **classic Personal Access Token (PAT)** with the
|
|
`delete:packages` scope. The `gh auth token` and `GITHUB_TOKEN` issued by
|
|
GitHub Actions do NOT include this scope and will fail with HTTP 403.
|
|
|
|
### Create a classic PAT 🔑
|
|
|
|
1. Go to [github.com/settings/tokens](https://github.com/settings/tokens).
|
|
2. Click **Generate new token → Generate new token (classic)**.
|
|
3. Enable the `delete:packages` scope.
|
|
4. Copy the generated token.
|
|
|
|
Export it before running the script:
|
|
|
|
```bash
|
|
export GITHUB_TOKEN=<your-pat>
|
|
```
|
|
|
|
## Usage 💻
|
|
|
|
```bash
|
|
python -m cli.contributing.mirror.cleanup \
|
|
--ghcr-namespace <user|org> \
|
|
--ghcr-prefix <repo>/mirror \
|
|
--visibility private \
|
|
--dry-run
|
|
```
|
|
|
|
Remove `--dry-run` to actually delete.
|
|
|
|
### Arguments ⚙️
|
|
|
|
| Argument | Default | Description |
|
|
|---|---|---|
|
|
| `--ghcr-namespace` | required | GitHub username or org that owns the packages |
|
|
| `--ghcr-prefix` | `mirror` | Only delete packages whose name starts with `<prefix>/` |
|
|
| `--visibility` | `private` | Delete packages with this visibility (`private`, `public`, `internal`) |
|
|
| `--dry-run` | off | List matching packages without deleting them |
|
|
|
|
## Example: Delete all private mirror packages for infinito-nexus-core 🧹
|
|
|
|
```bash
|
|
# Preview (requires a classic PAT with delete:packages)
|
|
GITHUB_TOKEN=<your-pat> python -m cli.contributing.mirror.cleanup \
|
|
--ghcr-namespace kevinveenbirkenbach \
|
|
--ghcr-prefix infinito-nexus-core/mirror \
|
|
--visibility private \
|
|
--dry-run
|
|
|
|
# Delete
|
|
GITHUB_TOKEN=<your-pat> python -m cli.contributing.mirror.cleanup \
|
|
--ghcr-namespace kevinveenbirkenbach \
|
|
--ghcr-prefix infinito-nexus-core/mirror \
|
|
--visibility private
|
|
```
|
|
|
|
## How It Works ⚙️
|
|
|
|
1. Resolves whether the namespace is a GitHub org or personal account.
|
|
2. Lists all container packages with the requested visibility via the
|
|
GitHub Packages REST API (`GET /user/packages` or `GET /orgs/{org}/packages`).
|
|
3. Filters by prefix.
|
|
4. Deletes each matching package via `DELETE /user/packages/container/{name}`
|
|
(or the org equivalent).
|
|
|
|
Pagination is handled automatically. The script exits non-zero if any
|
|
deletion fails.
|