ci: clean up after image builds and demo wipes

The build job runs docker on the runner host's daemon, so every run left
four tagged images behind for good. Remove this run's tags once they are
pushed and cap BuildKit's cache at 5 GB, always, never failing the job.

The demo wipe pulls every two hours; drop the dangling image each pull
replaces. The uom-deploy-runner deploy job is deliberately untouched.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

.gitea/workflows/build-images.yml

@@ -93,6 +93,22 @@ jobs:
           docker push "${BOT_IMAGE}:latest"
           docker push "${BOT_IMAGE}:${TAG}"
 
+      - name: Remove this run's images and cap the build cache
+        # The build runs on the HOST daemon, so whatever it leaves stays on the
+        # runner host for good: every run used to leave four tagged images, and
+        # each newer `latest` turned the previous one into a permanent `sha-` image
+        # until the host ran out of disk. Both tags are in the registry by now, so
+        # the local copies are dead weight. BuildKit keeps its layer cache apart
+        # from the images, so the next build stays fast; the cache is pruned to a
+        # cap instead of growing forever (`--reserved-space` is the same flag's
+        # name on newer Docker). Runs even after a failure, and never fails the job.
+        if: always()
+        run: |
+          docker image rm "${APP_IMAGE}:latest" "${APP_IMAGE}:${TAG}" \
+            "${BOT_IMAGE}:latest" "${BOT_IMAGE}:${TAG}" 2>/dev/null || true
+          docker builder prune -f --keep-storage 5GB \
+            || docker builder prune -f --reserved-space 5GB || true
+
       - name: Log out (clear cached credentials from the runner)
         if: always()
         run: docker logout "${REGISTRY}" || true

.gitea/workflows/demo-wipe.yml

@@ -110,6 +110,14 @@ jobs:
           docker run --rm --network rg-demo_default -v "$DEMO_DIR:/demo" \
             -e SITE_URL=http://app:3000 "$NODE_IMAGE" node /demo/rig.mjs smoke
 
+      - name: Remove the images this wipe replaced
+        # Each pull that finds a newer `latest` leaves the old image untagged on
+        # the demo host, every two hours. Untagged images are never used again, so
+        # drop them. Dangling images only: nothing tagged and nothing a container
+        # is using is touched.
+        if: always()
+        run: docker image prune -f || true
+
       - name: Report the rig restore
         if: steps.rig.outcome == 'failure'
         run: |