Nightly cleanup

.github/workflows/_deb_build.yml

@@ -82,11 +82,11 @@ jobs:
           deb_builder_tag=$(echo ${{inputs.base-tag}} | tr : - | tr / -)
           case "${{ inputs.pull-request }}" in
             true)
-              rti_license_file=${{ github.workspace }}/src/uno/rti_license.dat
+              rti_license_file=src/uno/rti_license.dat
               base_image=ghcr.io/mentalsmash/uno-ci-base-tester:${deb_builder_tag}
               ;;
             false)
-              rti_license_file=${{ github.workspace }}/src/uno-ci/docker/base-tester/resource/rti/rti_license.dat
+              rti_license_file=src/uno-ci/docker/base-tester/resource/rti/rti_license.dat
               base_image=${{ inputs.base-tag }}
               ;;
           esac
@@ -161,7 +161,7 @@ jobs:
     env:
       DEB_TESTER: ${{ needs.config.outputs.TEST_IMAGE }}
       FIX_DIR: ${{ github.workspace }}
-      RTI_LICENSE_FILE: ${{ needs.config.outputs.RTI_LICENSE_FILE }}
+      RTI_LICENSE_FILE: ${{ github.workspace }}/${{ needs.config.outputs.RTI_LICENSE_FILE }}
       TEST_DATE: ${{ needs.config.outputs.TEST_DATE }}
       TEST_ID: ${{ needs.config.outputs.TEST_ID }}
       TEST_IMAGE: ${{ needs.config.outputs.TEST_IMAGE }}

.github/workflows/pull_request_closed.yml

@@ -29,6 +29,10 @@ permissions:
 jobs:
   cleanup_jobs:
     runs-on: ubuntu-latest
+    # Run automatically only if the PR is from this repository,
+    # otherwise it won't be authorized to delete workflow runs.
+    # (suggested by https://github.com/orgs/community/discussions/25217)
+    if: github.event.pull_request.head.repo.full_name == github.repository
     steps:
       - name: Clone uno
         uses: actions/checkout@v4
@@ -55,8 +59,6 @@ jobs:
               -N ${{ github.event_name == 'pull_request' && github.event.pull_request.number || inputs.pr-number }} \
               ${{ (github.event_name == 'pull_request' && github.event.pull_request.merged || inputs.pr-merged) && '-m' || '' }}
         env:
-          # Changes to actions (e.g. delete workflow runs) require a PAT, and don't work with the GITHUB_TOKEN
-          # see https://docs.github.com/en/rest/actions/workflow-runs?apiVersion=2022-11-28#delete-a-workflow-run
-          GH_TOKEN: ${{ secrets.UNO_CI_ADMIN_PAT }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           ADMIN_IMAGE: ghcr.io/mentalsmash/uno-ci-admin:latest
 

.github/workflows/release_cleanup.yml

@@ -0,0 +1,50 @@
+name: Release (Cleanup)
+run-name: |
+  release cleanup [${{github.ref_type == 'tag' && 'stable' || 'nightly' }}, ${{github.ref_name}}]
+
+on:
+  workflow_dispatch:
+
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+
+concurrency:
+  group: release-cleanup-${{ github.ref }}
+  cancel-in-progress: false
+
+permissions:
+  actions: write
+  packages: read
+
+jobs:
+  cleanup_jobs:
+    if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Clone uno
+        uses: actions/checkout@v4
+        with:
+          path: src/uno
+          submodules: true
+
+      - name: Log in to GitHub
+        uses: docker/login-action@v3
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: "Clean up workflow runs"
+        run: |
+          docker run --rm \
+            -v $(pwd):/workspace \
+            -e GH_TOKEN=${GH_TOKEN} \
+            -w /workspace \
+            ${ADMIN_IMAGE} \
+            src/uno/scripts/ci-admin nightly-cleanup \
+              -r ${{ github.repository }}
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ADMIN_IMAGE: ghcr.io/mentalsmash/uno-ci-admin:latest
+