Skip to content

Commit c1ef59a

Browse files
gsanchiettigsanchietti
committed
feat(ci): add cleanup script (#7621)
Make sure to remove unused NS8 CI resources from Digital Ocean. The Github Action does only listing for now.
1 parent cf5c2e4 commit c1ef59a

File tree

2 files changed

+193
-0
lines changed

2 files changed

+193
-0
lines changed

‎.github/workflows/doctl-ns8-ci.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
name: Cleanup NS8 CI
2+
3+
on:
4+
schedule:
5+
# Runs every night at 04:00 UTC
6+
- cron: '0 4 * * *'
7+
workflow_dispatch:
8+
9+
jobs:
10+
run-doctl:
11+
name: Execute doctl-ns8-ci.sh --delete
12+
runs-on: ubuntu-latest
13+
env:
14+
# Common env var used by doctl; set it so scripts that read the token from env work.
15+
DIGITALOCEAN_ACCESS_TOKEN: ${{ secrets.NS8_CI_DIGITALOCEAN_TOKEN }}
16+
steps:
17+
- name: Checkout repository
18+
uses: actions/checkout@v5
19+
20+
- name: Install doctl and authenticate
21+
uses: digitalocean/action-doctl@v2
22+
with:
23+
token: ${{ secrets.NS8_CI_DIGITALOCEAN_TOKEN }}
24+
25+
- name: Remove unused NS8 CI resources
26+
run: ./scripts/doctl-ns8-ci.sh

‎scripts/doctl-ns8-ci.sh‎

Lines changed: 167 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
#!/usr/bin/env bash
2+
3+
# DigitalOcean NS8-CI cleanup candidate lister (and optional deleter)
4+
# Requirements: doctl, jq
5+
#
6+
# Usage:
7+
# ./doctl-ns8-ci.sh # just list
8+
# ./doctl-ns8-ci.sh --delete # list and delete
9+
10+
DO_DOMAIN="ci.nethserver.net"
11+
TAG_PREFIX="NS8-CI-"
12+
DELETE=0
13+
14+
if [[ "$1" == "--delete" ]]; then
15+
DELETE=1
16+
fi
17+
18+
set -e
19+
# Default $doctl_cmd context (can be overridden by exporting DOCTL_CONTEXT)
20+
DOCTL_CONTEXT="${DOCTL_CONTEXT:-sviluppo}"
21+
doctl_cmd="doctl --context $DOCTL_CONTEXT"
22+
23+
# Check if doctl is installed
24+
if ! command -v doctl &> /dev/null; then
25+
echo "doctl could not be found. Please install doctl and configure it with access token."
26+
exit 1
27+
fi
28+
29+
# Check if jq is installed
30+
if ! command -v jq &> /dev/null; then
31+
echo "jq could not be found. Please install jq."
32+
exit 1
33+
fi
34+
35+
36+
# Check if doctl can access DigitalOcean
37+
if ! $doctl_cmd account get &> /dev/null; then
38+
echo $DIGITALOCEAN_ACCESS_TOKEN | doctl --context sviluppo auth init --interactive false
39+
if ! $doctl_cmd account get &> /dev/null; then
40+
echo "doctl could not access DigitalOcean. Please use 'doctl auth init' to configure it or set the DIGITALOCEAN_ACCESS_TOKEN environment variable."
41+
exit 1
42+
fi
43+
fi
44+
45+
echo "== 1. Unused tags starting with $TAG_PREFIX =="
46+
mapfile -t ns8_tags < <($doctl_cmd compute tag list --format Name --no-header | grep "^$TAG_PREFIX" || true)
47+
# Remove unused tags (no droplets attached) as a first step
48+
for tag in "${ns8_tags[@]}"; do
49+
mapfile -t tag_droplets_check < <($doctl_cmd compute droplet list --tag-name "$tag" --format ID --no-header || true)
50+
if [[ ${#tag_droplets_check[@]} -eq 0 ]]; then
51+
echo "Unused tag: $tag"
52+
if [[ $DELETE -eq 1 ]]; then
53+
echo "-> Deleting tag $tag"
54+
$doctl_cmd compute tag delete "$tag" -f || true
55+
fi
56+
fi
57+
done
58+
59+
echo "== 2. Droplets with tags starting with $TAG_PREFIX (only 'active' and running > 3h) =="
60+
mapfile -t ns8_tags < <($doctl_cmd compute tag list --format Name --no-header | grep "^$TAG_PREFIX" || true)
61+
droplet_ids=()
62+
droplet_names=()
63+
# threshold in seconds (3 hours)
64+
THRESHOLD_SECONDS=10800
65+
for tag in "${ns8_tags[@]}"; do
66+
# Request fields via JSON so we reliably get created_at; parse with jq to: ID Status CreatedAt Name
67+
mapfile -t tag_droplets < <($doctl_cmd compute droplet list --tag-name "$tag" -o json | jq -r '.[] | "\(.id) \(.status) \(.created_at) \(.name)"')
68+
for entry in "${tag_droplets[@]}"; do
69+
id=$(echo "$entry" | awk '{print $1}')
70+
status=$(echo "$entry" | awk '{print $2}')
71+
created_at=$(echo "$entry" | awk '{print $3}')
72+
name=$(echo "$entry" | cut -d' ' -f4-)
73+
echo "$entry"
74+
echo "id=$id status=$status created_at=$created_at name=$name"
75+
76+
# Skip if we couldn't parse fields
77+
if [[ -z "$id" || -z "$created_at" ]]; then
78+
continue
79+
fi
80+
81+
# Only consider active droplets
82+
if [[ "$status" != "active" ]]; then
83+
continue
84+
fi
85+
86+
# Parse created_at to epoch and compute age
87+
created_epoch=$(date -d "$created_at" +%s 2>/dev/null || true)
88+
if [[ -z "$created_epoch" ]]; then
89+
# fallback: skip if date parsing fails
90+
continue
91+
fi
92+
now_epoch=$(date +%s)
93+
age=$(( now_epoch - created_epoch ))
94+
95+
if (( age > THRESHOLD_SECONDS )); then
96+
droplet_ids+=("$id")
97+
droplet_names+=("$name")
98+
# show human-friendly age in hours (with integer hours)
99+
age_hours=$(( age / 3600 ))
100+
echo "Droplet: $name ($id) [tag: $tag] status=$status age=${age_hours}h"
101+
if [[ $DELETE -eq 1 ]]; then
102+
echo "-> Deleting droplet $name ($id)"
103+
$doctl_cmd compute droplet delete "$id" -f
104+
fi
105+
fi
106+
done
107+
done
108+
109+
echo ""
110+
echo "== 3. DNS records in $DO_DOMAIN without a running droplet =="
111+
mapfile -t records < <($doctl_cmd compute domain records list "$DO_DOMAIN" --format ID,Type,Name --no-header)
112+
for record in "${records[@]}"; do
113+
id=$(echo "$record" | awk '{print $1}')
114+
type=$(echo "$record" | awk '{print $2}')
115+
name=$(echo "$record" | awk '{print $3}')
116+
if [[ "$type" == "A" || "$type" == "AAAA" ]]; then
117+
found=0
118+
for dname in "${droplet_names[@]}"; do
119+
if [[ "$dname" == "$name" ]]; then
120+
found=1
121+
break
122+
fi
123+
done
124+
if [[ $found -eq 0 ]]; then
125+
echo "Orphan DNS $type record: $name.$DO_DOMAIN (record id: $id)"
126+
if [[ $DELETE -eq 1 ]]; then
127+
echo "-> Deleting DNS record $id ($name.$DO_DOMAIN)"
128+
$doctl_cmd compute domain records delete "$DO_DOMAIN" "$id" -f
129+
fi
130+
fi
131+
fi
132+
done
133+
134+
echo ""
135+
echo "== 3. SSH keys with names matching '^*ci.nethserver.net-deploy' not used by any droplet =="
136+
# Collect SSH keys matching '.ci.nethserver.net' using the same template you provided
137+
mapfile -t ssh_keys_raw < <($doctl_cmd compute ssh-key list --format ID,Name --no-header | grep '\.ci\.nethserver\.net' || true)
138+
mapfile -t all_droplet_ids < <($doctl_cmd compute droplet list --format ID --no-header)
139+
140+
for ssh_entry in "${ssh_keys_raw[@]}"; do
141+
ssh_id=$(echo "$ssh_entry" | awk '{print $1}')
142+
ssh_name=$(echo "$ssh_entry" | cut -d' ' -f2-)
143+
ssh_used=0
144+
for droplet_id in "${all_droplet_ids[@]}"; do
145+
mapfile -t droplet_keys < <($doctl_cmd compute droplet get "$droplet_id" --format SSHKeys --no-header | tr ',' '\n' | awk '{print $1}')
146+
for dkey in "${droplet_keys[@]}"; do
147+
if [[ "$dkey" == "$ssh_id" ]]; then
148+
ssh_used=1
149+
break 2
150+
fi
151+
done
152+
done
153+
if [[ $ssh_used -eq 0 ]]; then
154+
echo "Unused SSH key: $ssh_name ($ssh_id)"
155+
if [[ $DELETE -eq 1 ]]; then
156+
echo "-> Deleting SSH key $ssh_name ($ssh_id)"
157+
$doctl_cmd compute ssh-key delete "$ssh_id" -f
158+
fi
159+
fi
160+
done
161+
162+
echo ""
163+
if [[ $DELETE -eq 1 ]]; then
164+
echo "Done. All listed resources were deleted."
165+
else
166+
echo "Done. No resources were deleted (listing mode)."
167+
fi

0 commit comments

Comments
 (0)