misc-scripts/CHANGELOG.md

Changelog — misc-scripts

All notable changes to the operator helper scripts. Newest on top.

2026-10-01

Changed — gitea-image-prune.sh: the retention rule (Felhom 09 §3 decision 62, R-750)

• A prune keeps the newest 20 versions (--keep defaults to 20) plus every version in use: the controller floor, the vouched golden, the vouched agent and its min_agent (the hub's operator Configuration page, HUB_PW), every image of ours the vouched golden baked (its bake.log in felhom.eu), and the hub image manifests/hub.yaml runs. The dry-run prints each kept version and why. An unreadable in-use list refuses the prune (exit 3).
• tests/test-prune-plan.sh (no network: test seams PRUNE_TEST_VERSIONS, PRUNE_TEST_PROTECT): an in-use version older than the newest 20 stays; red-proof: without the in-use list it is deleted, and with the check removed from is_protected the test fails.
• The "cron-friendly" and "set-and-forget Gitea rule" advice removed: nothing schedules a prune; --apply is a person's act.
• Recorded: the 2026-08-22 16:02 UTC run (--all --keep 7 --apply, HM-024) predates this rule — it is why the oldest felhom-controller left is 0.213.0.

2026-06-17 (later)

Changed — gitea-image-prune.sh

• Credential auto-discovery: when GITEA_TOKEN/--token-file are not set and the script runs inside a Gitea-host clone, it reuses git's stored credential — the token embedded in the remote URL, else a configured credential helper (git credential fill, never prompting). Lets you run it from a configured clone with no token. Startup banner reports the credential source + user.
• Auth now uses HTTP Basic (user:token) when a username is known (so both API tokens and the embedded-URL/helper credential work), falling back to the Authorization: token header for a bare GITEA_TOKEN. Live-verified both paths (env token; git credential helper as kisfenyo).

2026-06-17

Added — gitea-image-prune.sh

• New operator CLI to inspect and prune old container images in the self-hosted Gitea registry (gitea.dooplex.hu, owner admin) and reclaim disk on the Longhorn-backed packages PVC. Pure curl + jq; interactive menu + scriptable flags. Safe dry-run default.
• Modes: list (per-tag upload date + apparent image size, newest-first, shared-layer caveat), prune (--keep N or --older-than DAYS; always protects ^latest$ + --protect regexes), reclaim (delete orphaned manifest versions + trigger/await the cleanup_packages GC cron). --measure does best-effort before/after du via kubectl.
• Implements the three-step reclaim mechanism proven live on Gitea 1.26.2: deleting a tag frees only the index pointer; the orphaned sha256: manifest versions must also be deleted (default cleanup_packages does not remove untagged manifests); the cron then GCs the unreferenced blobs. Orphan detection is fail-closed.
• Safety: orders by upload date (never parses mixed v/bare tags), checks every HTTP status, never echoes/logs the token, audit log per run, typed confirmation on --apply (stricter for --all).
• Token via GITEA_TOKEN/--token-file. Minimal scopes documented in README: read:package (list), write:package (delete), read:admin (cron list), write:admin (cron trigger).
• README section added documenting usage, scopes, the reclaim caveat, the live verification result, and the native cleanup-rule recommendation.

Changed — Gitea instance (operational, not a script change)

• Added [cron.cleanup_packages] RUN_AT_START = true to Gitea's app.ini (on the data PVC) so the package GC also runs on every Gitea restart. Enables reclaim without a write:admin token. Backup at app.ini.bak.prune-spike.