Skip to content

Commit 2b0143b

Browse files
gsanchiettigsanchietti
authored
feat(ci): add cleanup script (#7621)
Make sure to remove unused NS8 CI resources from Digital Ocean. The Github Action does only listing for now.
1 parent cf5c2e4 commit 2b0143b

File tree

2 files changed

+174
-0
lines changed

2 files changed

+174
-0
lines changed

‎.github/workflows/doctl-ns8-ci.yml‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
name: Cleanup NS8 CI
2+
3+
on:
4+
schedule:
5+
# Runs every night at 04:00 UTC
6+
- cron: '0 4 * * *'
7+
workflow_dispatch:
8+
9+
jobs:
10+
run-doctl:
11+
name: Execute doctl-ns8-ci.sh --delete
12+
runs-on: ubuntu-latest
13+
env:
14+
# Common env var used by doctl; set it so scripts that read the token from env work.
15+
DOCTL_ACCESS_TOKEN: ${{ secrets.NS8_CI_DIGITALOCEAN_TOKEN }}
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v5
19+
20+
- name: Install doctl and authenticate
21+
uses: digitalocean/action-doctl@v2
22+
with:
23+
token: ${{ secrets.NS8_CI_DIGITALOCEAN_TOKEN }}
24+
25+
- name: Remove unused NS8 CI resources
26+
run: ./scripts/doctl-ns8-ci.sh
27+
env:
28+
# Provide the common doctl env var at runtime
29+
DOCTL_ACCESS_TOKEN: ${{ secrets.NS8_CI_DIGITALOCEAN_TOKEN }}

‎scripts/doctl-ns8-ci.sh‎

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
#!/usr/bin/env bash
2+
3+
# DigitalOcean NS8-CI cleanup candidate lister (and optional deleter)
4+
# Requirements: doctl, jq
5+
#
6+
# Usage:
7+
# ./doctl-ns8-ci.sh # just list
8+
# ./doctl-ns8-ci.sh --delete # list and delete
9+
10+
DO_DOMAIN="ci.nethserver.net"
11+
TAG_PREFIX="NS8-CI-"
12+
DELETE=0
13+
14+
if [[ "$1" == "--delete" ]]; then
15+
DELETE=1
16+
fi
17+
18+
set -e
19+
# Default $doctl_cmd context (can be overridden by exporting DOCTL_CONTEXT)
20+
DOCTL_CONTEXT="${DOCTL_CONTEXT:-sviluppo}"
21+
doctl_cmd="doctl --context $DOCTL_CONTEXT"
22+
23+
echo "== 1. Unused tags starting with $TAG_PREFIX =="
24+
mapfile -t ns8_tags < <($doctl_cmd compute tag list --format Name --no-header | grep "^$TAG_PREFIX" || true)
25+
# Remove unused tags (no droplets attached) as a first step
26+
for tag in "${ns8_tags[@]}"; do
27+
mapfile -t tag_droplets_check < <($doctl_cmd compute droplet list --tag-name "$tag" --format ID --no-header || true)
28+
if [[ ${#tag_droplets_check[@]} -eq 0 ]]; then
29+
echo "Unused tag: $tag"
30+
if [[ $DELETE -eq 1 ]]; then
31+
echo "-> Deleting tag $tag"
32+
$doctl_cmd compute tag delete "$tag" -f || true
33+
fi
34+
fi
35+
done
36+
37+
echo "== 2. Droplets with tags starting with $TAG_PREFIX (only 'active' and running > 3h) =="
38+
mapfile -t ns8_tags < <($doctl_cmd compute tag list --format Name --no-header | grep "^$TAG_PREFIX" || true)
39+
droplet_ids=()
40+
droplet_names=()
41+
# threshold in seconds (3 hours)
42+
THRESHOLD_SECONDS=10800
43+
for tag in "${ns8_tags[@]}"; do
44+
# Request fields via JSON so we reliably get created_at; parse with jq to: ID Status CreatedAt Name
45+
mapfile -t tag_droplets < <($doctl_cmd compute droplet list --tag-name "$tag" -o json | jq -r '.[] | "\(.id) \(.status) \(.created_at) \(.name)"')
46+
for entry in "${tag_droplets[@]}"; do
47+
id=$(echo "$entry" | awk '{print $1}')
48+
status=$(echo "$entry" | awk '{print $2}')
49+
created_at=$(echo "$entry" | awk '{print $3}')
50+
name=$(echo "$entry" | cut -d' ' -f4-)
51+
echo "$entry"
52+
echo "id=$id status=$status created_at=$created_at name=$name"
53+
54+
# Skip if we couldn't parse fields
55+
if [[ -z "$id" || -z "$created_at" ]]; then
56+
continue
57+
fi
58+
59+
# Only consider active droplets
60+
if [[ "$status" != "active" ]]; then
61+
continue
62+
fi
63+
64+
# Parse created_at to epoch and compute age
65+
created_epoch=$(date -d "$created_at" +%s 2>/dev/null || true)
66+
if [[ -z "$created_epoch" ]]; then
67+
# fallback: skip if date parsing fails
68+
continue
69+
fi
70+
now_epoch=$(date +%s)
71+
age=$(( now_epoch - created_epoch ))
72+
73+
if (( age > THRESHOLD_SECONDS )); then
74+
droplet_ids+=("$id")
75+
droplet_names+=("$name")
76+
# show human-friendly age in hours (with integer hours)
77+
age_hours=$(( age / 3600 ))
78+
echo "Droplet: $name ($id) [tag: $tag] status=$status age=${age_hours}h"
79+
if [[ $DELETE -eq 1 ]]; then
80+
echo "-> Deleting droplet $name ($id)"
81+
$doctl_cmd compute droplet delete "$id" -f
82+
fi
83+
fi
84+
done
85+
done
86+
87+
echo ""
88+
echo "== 3. DNS records in $DO_DOMAIN without a running droplet =="
89+
mapfile -t records < <($doctl_cmd compute domain records list "$DO_DOMAIN" --format ID,Type,Name --no-header)
90+
for record in "${records[@]}"; do
91+
id=$(echo "$record" | awk '{print $1}')
92+
type=$(echo "$record" | awk '{print $2}')
93+
name=$(echo "$record" | awk '{print $3}')
94+
if [[ "$type" == "A" || "$type" == "AAAA" ]]; then
95+
found=0
96+
for dname in "${droplet_names[@]}"; do
97+
if [[ "$dname" == "$name" ]]; then
98+
found=1
99+
break
100+
fi
101+
done
102+
if [[ $found -eq 0 ]]; then
103+
echo "Orphan DNS $type record: $name.$DO_DOMAIN (record id: $id)"
104+
if [[ $DELETE -eq 1 ]]; then
105+
echo "-> Deleting DNS record $id ($name.$DO_DOMAIN)"
106+
$doctl_cmd compute domain records delete "$DO_DOMAIN" "$id" -f
107+
fi
108+
fi
109+
fi
110+
done
111+
112+
echo ""
113+
echo "== 3. SSH keys with names matching '^*ci.nethserver.net-deploy' not used by any droplet =="
114+
# Collect SSH keys matching '.ci.nethserver.net' using the same template you provided
115+
mapfile -t ssh_keys_raw < <($doctl_cmd compute ssh-key list --format ID,Name --no-header | grep '\.ci\.nethserver\.net' || true)
116+
mapfile -t all_droplet_ids < <($doctl_cmd compute droplet list --format ID --no-header)
117+
118+
for ssh_entry in "${ssh_keys_raw[@]}"; do
119+
ssh_id=$(echo "$ssh_entry" | awk '{print $1}')
120+
ssh_name=$(echo "$ssh_entry" | cut -d' ' -f2-)
121+
ssh_used=0
122+
for droplet_id in "${all_droplet_ids[@]}"; do
123+
mapfile -t droplet_keys < <($doctl_cmd compute droplet get "$droplet_id" --format SSHKeys --no-header | tr ',' '\n' | awk '{print $1}')
124+
for dkey in "${droplet_keys[@]}"; do
125+
if [[ "$dkey" == "$ssh_id" ]]; then
126+
ssh_used=1
127+
break 2
128+
fi
129+
done
130+
done
131+
if [[ $ssh_used -eq 0 ]]; then
132+
echo "Unused SSH key: $ssh_name ($ssh_id)"
133+
if [[ $DELETE -eq 1 ]]; then
134+
echo "-> Deleting SSH key $ssh_name ($ssh_id)"
135+
$doctl_cmd compute ssh-key delete "$ssh_id" -f
136+
fi
137+
fi
138+
done
139+
140+
echo ""
141+
if [[ $DELETE -eq 1 ]]; then
142+
echo "Done. All listed resources were deleted."
143+
else
144+
echo "Done. No resources were deleted (listing mode)."
145+
fi

0 commit comments

Comments
 (0)