werkrevisor/docs/prs/2026-10-09-PR#69-keep-two-archives.md

PR#69: Release Tools Keep Only the Two Newest Archives

WARNING: This document describes only the change applied in this PR. It may already be outdated once the next PR is merged. Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.

The Problem

tools/build-rootfs writes a new archive of about 183 MB for each release and never deletes one. In three weeks, 51 archives with about 9 GB collected in the repository directory, and 52 tags of the image. The deploy to the review machine is a sequence of manual steps; nothing removes old archives there either. Without a fix, each release fills the disk further.

Non-Goals

• No change to the archive itself or to how Werkator runs it.
• The tools touch only files named werkrevisor-rootfs-<version>.tar.zst and image tags werkrevisor:<version>.

The Scenarios

Feature: a release keeps only the two newest archives

Scenario#69.01: the build keeps the two newest local archives

So that the repository directory does not grow with each release.

• Given the archives of the versions 0.9.0, 0.30.1, 0.31.0 and 0.31.1 in the repository directory
• When tools/build-rootfs has built version 0.31.2
• Then only the archives of 0.31.1 and 0.31.2 remain
• And only the image tags of 0.31.1 and 0.31.2 remain

Verified by

• test_release_tools.ReleaseToolsTest.test_keep_newest_keeps_the_two_highest_versions

Scenario#69.02: the deploy removes no archive that a config still uses

So that a running review never loses its file system.

• Given the target holds the archives 0.30.0, 0.31.0 and 0.31.1
• And a .werkator.yml still names 0.30.0
• When tools/deploy-rootfs deploys 0.31.2
• Then the target keeps 0.30.0, 0.31.1 and 0.31.2
• And it removes 0.31.0

Verified by

• test_release_tools.ReleaseToolsTest.test_an_archive_in_use_is_never_removed

The Solution

• tools/release_files.py selects the files to remove: all but the two highest versions, never one in use.
• tools/build-rootfs removes older local archives and image tags after a successful build.
• tools/deploy-rootfs <archive> <ssh-target> <directory> <repo>… uploads the archive, switches the rootfs of each repository's .werkator.yml after a backup, and keeps the two newest archives and the two newest backups per repository on the target.
• The README describes both tools; the Werkbaum records them.
• Version 0.31.3.

Additional Changes

• The Werkbaum marks "werkator gets its own .werkrevisor.toml" as live since werkator PR#128.
• The Werkbaum note #triage.risk.ts claimed that the security question rated three planted defects at most 0.11; it rated two of them so, and token_handling at 0.96 (hint of the review of PR#68).