ci: build and clean containers on PRs

Make it so that our containers are built for every PR and pushed so we
can test with them. Then when the PR is closed delete the container to
clean up after ourselves.

.github/workflows/containers.yaml

@@ -8,7 +8,8 @@ on:
       - "containers/**"
       - ".github/workflows/containers.yaml"
       - "python/**"
-  pull_request:
+  pull_request_target:
+    types: [opened, synchronize, reopened, closed]
     paths:
       - "containers/**"
       - ".github/workflows/containers.yaml"
@@ -28,7 +29,6 @@ jobs:
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v3
       - name: login to ghcr.io
-        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -59,7 +59,7 @@ jobs:
           file: containers/Dockerfile.${{ matrix.project }}
           build-args: OPENSTACK_VERSION=${{ matrix.openstack }}
           pull: true  # ensure we always have an up to date source
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
@@ -71,7 +71,6 @@ jobs:
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v3
       - name: login to ghcr.io
-        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -100,7 +99,7 @@ jobs:
         uses: docker/build-push-action@v5
         with:
           file: containers/Dockerfile.dnsmasq
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
 
@@ -116,7 +115,6 @@ jobs:
       - name: setup docker buildx
         uses: docker/setup-buildx-action@v3
       - name: login to ghcr.io
-        if: ${{ github.event_name != 'pull_request' }}
         uses: docker/login-action@v3
         with:
           registry: ghcr.io
@@ -146,9 +144,59 @@ jobs:
         with:
           file: containers/Dockerfile.${{ matrix.container.name }}
           pull: true  # ensure we always have an up to date source
-          push: ${{ github.event_name != 'pull_request' }}
+          push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}
           annotations: ${{ steps.meta.outputs.annotations }}
           # prod is the target that has the code installed
           target: prod
+
+  clean_containers:
+    if: github.event_name == 'pull_request' && github.event.action == 'closed'
+    runs-on: ubuntu-latest
+
+    permissions:
+      packages: write
+
+    strategy:
+      matrix:
+        container:
+          - ironic
+          - neutron
+          - dnsmasq
+          - ironic-nautobot-client
+
+    steps:
+      - name: clean up PR container
+        uses: actions/github-script@v7
+        env:
+          CONTAINER_NAME: '${{ matrix.container }}'
+        with:
+          script: |
+            const container_name = `understack%2F${process.env.CONTAINER_NAME}`;
+            const response = github.rest.packages.getAllPackageVersionsForPackageOwnedByOrg({
+              package_type: "container",
+              package_name: process.env.CONTAINER_NAME,
+              org: context.repo.owner,
+            });
+
+            const target_tag = `pr-${context.payload.pull_request.number}`;
+            console.log(`Looking for tag ${target_tag}` for container ${container_name}`);
+
+            const versions = response.data;
+            const matchingVersion = versions.find(version =>
+              version.metadata.container.tags.includes(target_tag)
+            );
+
+            if (matchingVersion) {
+              console.log(`Found tag to delete "${target_tag}":`, matchingVersion);
+              await github.rest.packages.deletePackageVersionForOrg({
+                package_type: "container",
+                package_name: container_name,
+                org: context.repo.owner,
+                package_version_id: pkg_id,
+              });
+              console.log("Tag deleted");
+            } else {
+              console.log(`No package version found with the tag "${target_tag}".`);
+            }