feat: auto cleanup old images, keep latest 5 versions per repo

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.gitea/workflows/deploy.yaml

@@ -123,6 +123,41 @@ jobs:
             kubectl rollout restart deployment/log-center-web
           } 2>&1 | tee /tmp/deploy.log
 
+      # ==================== 清理旧镜像（保留最近5个版本） ====================
+
+      - name: Clean old images
+        if: success()
+        run: |
+          KEEP=5
+          CR="${{ secrets.CR_SERVER }}"
+          ORG="${{ env.CR_ORG }}"
+          AUTH="${{ secrets.CR_USERNAME }}:${{ secrets.CR_PASSWORD }}"
+
+          for REPO in log-center-api log-center-web k8s-pod-monitor; do
+            echo "Cleaning ${ORG}/${REPO}..."
+            TAGS=$(curl -s -u "${AUTH}" "https://${CR}/v2/${ORG}/${REPO}/tags/list" 2>/dev/null | \
+              python3 -c "
+          import sys,json
+          try:
+            data = json.load(sys.stdin)
+            tags = [t for t in data.get('tags',[]) if t != 'latest']
+            tags.sort(reverse=True)
+            for t in tags[${KEEP}:]:
+              print(t)
+          except: pass
+          " 2>/dev/null)
+
+            for TAG in $TAGS; do
+              DIGEST=$(curl -s -I -H 'Accept: application/vnd.docker.distribution.manifest.v2+json' \
+                -u "${AUTH}" "https://${CR}/v2/${ORG}/${REPO}/manifests/${TAG}" 2>/dev/null | \
+                grep -i docker-content-digest | awk '{print $2}' | tr -d '\r')
+              if [ -n "$DIGEST" ]; then
+                curl -s -X DELETE -u "${AUTH}" "https://${CR}/v2/${ORG}/${REPO}/manifests/${DIGEST}" 2>/dev/null
+                echo "  Deleted: ${TAG}"
+              fi
+            done
+          done
+
       # ==================== CI/CD 错误上报 ====================
 
       - name: Report failure to Log Center