Audit and batch-delete stale GHCR container image versions with human review.
npx skills add https://github.com/posit-dev/positron --skill prune-ci-images
Please help me install this Agent Skill. Skill: prune-ci-images Source: https://github.com/posit-dev/positron/tree/main/.claude/skills/prune-ci-images Command: npx skills add https://github.com/posit-dev/positron --skill prune-ci-images
Old CI container images accumulate in the GitHub Container Registry, cluttering the package list and making it hard to tell which versions are still load-bearing. Deleting them blindly is dangerous: untagged per-arch manifests look like garbage but are referenced by live multi-arch indexes, and removing them breaks tagged images.
positron-rocky8 and positron-postgres image versions without breaking any CI workflow that still pins an old tag.Ask the assistant to audit old GHCR CI images older than 90 days and produce a review list for pruning.
High-intent search queries and answers about installing and using this skill.
Run ghcr-audit.sh to produce a markdown review list of versions older than the cutoff, have a human delete rows they want to keep, then run ghcr-prune.sh with --confirm. The prune step re-validates everything against the live registry and aborts on any drift.
Use the gh api endpoints for org packages: list versions, delete them by ID, and optionally delete whole packages. This skill wraps those calls in scripts that check tags, resolve multi-arch manifests, and require explicit confirmation before deleting.
GHCR blocks deletion of a package's final tagged version and reports it either as a last-tagged-version error or a misleading 5000-downloads message. The only way to clear it is a package-level delete, which ghcr-delete-packages.sh handles as a separate approved step.
Yes. Multi-arch builds push an index plus untagged per-arch manifests into the same package, and deleting those children breaks the tagged image. The audit resolves every retained index and protects its child digests, and the prune step re-derives this protection before deleting.
The gh token needs read:packages for the audit and delete:packages for pruning, plus admin rights on the packages themselves. Org member read access alone is not sufficient to delete versions or packages.
The scan reads only the working tree and matches literal ghcr.io/owner/pkg:tag strings under .github/, docker/, test/, scripts/, and build/. Tags referenced only on other branches, assembled from variables at runtime, or living in external repos are invisible, so pass --protect-tag for those.
sayali-ingle-pdlGenerate per-scope npm registry mappings for GitHub Packages without embedding credentials.
redacharfUpdate pnpm versions and pin pnpm/action-setup workflow references to latest release SHA.
sun2adminGenerate a private Layer 3 Claude Code plugin container image and publish it to GHCR.
ToanPV90Manage container registry operations including push/pull, authentication, lifecycle policies, and security controls.