Recover verified terminal review tags and inventory disk owners

.gitea/workflows/creative-browser-diagnostics.yml

@@ -1,25 +1,41 @@
-name: creative review image cleanup preview
+name: creative disk recovery and inventory
 on:
   push:
     branches: [codex/creative-browser-diagnosis]
 jobs:
   diagnose:
     runs-on: ces-control
-    timeout-minutes: 5
+    timeout-minutes: 15
     steps:
-      - name: Preview only terminal canvas review image tags without deleting
+      - name: Recover only verified terminal review tags and measure disk use
         run: |
           set -euo pipefail
-          referenced=$(docker ps -aq | xargs -r docker inspect --format '{{.Image}}' | sort -u)
+          df -h /
           for sha in 2cc6f1f5433331758e825cc5cf3f5246d6101475 40c1023a86b3db7f6dd87743074b85e47e9225d2 a589f51698dad4a6dfb36ded3a107e1d537f1fe3 ab5ea7876b9d0eb0d7b56a02daf106fa2d0ccdde; do
             for repository in creative-studio-review creative-wiki-tests creative-wiki-review; do
               tag="$repository:$sha"
               if ! image=$(docker image inspect --format '{{.Id}}' "$tag" 2>/dev/null); then continue; fi
               docker image inspect --format '{{.Id}} size={{.Size}} tags={{json .RepoTags}} project={{with index .Config "Labels"}}{{index . "io.entroia.project"}}{{end}} created={{.Created}}' "$tag"
+              referenced=$(docker ps -aq | xargs -r docker inspect --format '{{.Image}}' | sort -u)
               if printf '%s\n' "$referenced" | grep -Fxq "$image"; then
                 echo "KEEP: container reference $tag"
               else
-                echo "CANDIDATE: terminal review tag $tag (no removal in this job)"
+                docker image rm "$tag"
               fi
             done
           done
+          df -h /
+          docker info --format 'docker-root={{.DockerRootDir}} storage={{.Driver}}'
+          timeout 240s du -x -h -d 1 /var/lib/docker /var/lib/containerd /root/.cache/act /opt /var/log 2>/dev/null | sort -h || true
+          echo 'VOLUME OWNERSHIP AND SIZE (metadata only)'
+          for volume in $(docker volume ls -q); do
+            docker volume inspect --format '{{.Name}} path={{.Mountpoint}} project={{with index . "Labels"}}{{index . "com.docker.compose.project"}}{{end}}' "$volume"
+            mount=$(docker volume inspect --format '{{.Mountpoint}}' "$volume")
+            timeout 20s du -s -B 1 "$mount" 2>/dev/null || true
+          done
+          echo 'CONTAINER OWNERSHIP AND LOG SIZE (metadata only)'
+          for container in $(docker ps -aq); do
+            docker inspect --format '{{.Id}} {{.Name}} status={{.State.Status}} project={{with index .Config "Labels"}}{{index . "com.docker.compose.project"}}{{end}} build={{with index .Config "Labels"}}{{index . "io.entroia.wiki.build"}}{{end}} owner={{with index .Config "Labels"}}{{index . "io.entroia.project"}}{{end}}' "$container"
+            log=$(docker inspect --format '{{.LogPath}}' "$container")
+            if [ -n "$log" ]; then du -s -B 1 "$log" 2>/dev/null || true; fi
+          done