From 0d17a955b7dffc86dedb3a85ed8c34f67eb7b3b9 Mon Sep 17 00:00:00 2001
From: Tao Li <tao.li@enterprisedb.com>
Date: Thu, 13 Aug 2026 13:39:23 +0800
Subject: [PATCH 1/2] ci: add workflow to cleanup -testing operand image

Signed-off-by: Tao Li <tao.li@enterprisedb.com>
---
 .github/workflows/registry-clean.yml | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)
 create mode 100644 .github/workflows/registry-clean.yml

diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml
new file mode 100644
index 00000000..f88aead2
--- /dev/null
+++ b/.github/workflows/registry-clean.yml
@@ -0,0 +1,27 @@
+# This workflow runs daily to clean up the `*-testing` images older than the
+# cut-off period specified in `snok/container-retention-policy`
+name: clean-testing-package
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 0 * * *'
+
+env:
+  IMAGE_NAME: "postgresql-testing"
+
+jobs:
+  clean-ghcr:
+    name: delete old testing container images
+    permissions:
+      packages: write
+    runs-on: ubuntu-latest
+    steps:
+      - name: Delete '-testing' operand images in ${{ env.IMAGE_NAME }}
+        uses: snok/container-retention-policy@d3bdcf5ce9b05f685154e4a16c39233b245e3d53 # v3.1.0
+        with:
+          image-names: ${{ env.IMAGE_NAME }}
+          cut-off: 1w
+          keep-n-most-recent: 1
+          account: ${{ github.repository_owner }}
+          token: ${{ secrets.GITHUB_TOKEN }}

From 615de45db2ad8db09addca41fe42ce2c19890de7 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Niccol=C3=B2=20Fei?= <niccolo.fei@enterprisedb.com>
Date: Thu, 20 Aug 2026 14:12:25 +0200
Subject: [PATCH 2/2] chore: reduce permissions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Niccolò Fei <niccolo.fei@enterprisedb.com>
---
 .github/workflows/registry-clean.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/registry-clean.yml b/.github/workflows/registry-clean.yml
index f88aead2..f2032bbd 100644
--- a/.github/workflows/registry-clean.yml
+++ b/.github/workflows/registry-clean.yml
@@ -7,6 +7,8 @@ on:
   schedule:
     - cron: '0 0 * * *'
 
+permissions: {}
+
 env:
   IMAGE_NAME: "postgresql-testing"
 
@@ -14,6 +16,7 @@ jobs:
   clean-ghcr:
     name: delete old testing container images
     permissions:
+      contents: read
       packages: write
     runs-on: ubuntu-latest
     steps: