delete-only-untagged-versions seems to eat also manifests of tagged versions

[jan-kiszka]

It looks to me like we just lost several historic container releases over at https://github.com/siemens/kas due to this action - or my wrong usage of it - and I like to understand the reason.

This is what we had in our pipeline for the last days, purging already hundreds of untagged containers:

      - name: Purge oldest untagged kas images
        uses: actions/delete-package-versions@v5
        with:
          package-name: kas/kas
          package-type: container
          min-versions-to-keep: 10
          delete-only-untagged-versions: true
      - name: Purge oldest untagged kas-isar images
        uses: actions/delete-package-versions@v5
        with:
          package-name: kas-isar
          package-type: container
          min-versions-to-keep: 10
          delete-only-untagged-versions: true

But now we also lost some containers that still appear with their tags, e.g. https://github.com/siemens/kas/pkgs/container/kas%2Fkas/9259655?tag=2.6, but can't be pulled anymore:

$ podman pull ghcr.io/siemens/kas/kas:2.6
Trying to pull ghcr.io/siemens/kas/kas:2.6...
Error: copying system image from manifest list: determining manifest MIME type for docker://ghcr.io/siemens/kas/kas:2.6: reading manifest sha256:af8ae21cf50cf218f79d0eb7dbf2048cdb692bfccfa958583a7fe63e2e3860e1 in ghcr.io/siemens/kas/kas: manifest unknown

I've restored many already from local copies, but I'm missing kas:2.6, and all the affected non-x86 variants are also lost now.

Any idea what could have caused this?

[jan-kiszka]

Oh, what makes me believe that only the manifests were lost:

$ docker push ghcr.io/siemens/kas/kas-isar:3.0.2  
The push refers to repository [ghcr.io/siemens/kas/kas-isar]
cf7c1df73f96: Layer already exists  
0a6da80d69f5: Layer already exists  
7a35b573a2e8: Layer already exists  
e3edee85b1da: Layer already exists  
0e1f20d37bb5: Layer already exists  
7b2de4bc116d: Layer already exists  
10249e640a6d: Layer already exists  
ce415e45937b: Layer already exists  
95b7ce0949a8: Layer already exists  
a24d3ead0b0c: Layer already exists  
66b170a1908d: Layer already exists  
1401df2b50d5: Layer already exists  
3.0.2: digest: sha256:7b020ab2f23509c7f894241c572f275abc7b262f105fcb911d352e26836a5fb1 size: 2830

This restored kas-isar:3.0.2 by pushing the local version (for amd64 only) once again.

[jan-kiszka]

Might be related: #90

[jan-kiszka]

Via manual un-deleting of some hundreds of packages, I was able to restore also kas:2.6. However, the arm64 containers remain lost because I restored the other releases by uploading amd64-only manifests. The usual pattern: first, you lose something, and then you make it worse while trying to recover. But I had users in my back, complaining already.

I'm still highly irritated that this action is provided without a single warning about its fundamental limitation (or flaw?) regarding multi-arch containers, and that although this is now known for many months!