reinstate public withdraw workflows (#2860)

Signed-off-by: Jason Hall <[email protected]>

.github/workflows/withdraw-images.yaml

@@ -0,0 +1,37 @@
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        type: boolean
+        default: 'true'
+        description: If true, just log
+
+permissions:
+  contents: read
+
+jobs:
+  withdraw:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: chainguard-dev/setup-chainctl@4c4c132b7b1dd7c9283ff5331e3190ecf9a35755 # v0.1.1
+        with:
+          identity: 720909c9f5279097d847ad02a2f24ba8f59de36a/b6461e99e132298f
+      - uses: imjasonh/setup-crane@00c9e93efa4e1138c9a7a5c594acd6c75a2fbf0c # v0.3
+      - run: |
+          for img in $(grep -v '\#' withdrawn-images.txt); do
+            if [[ "${{ github.event.inputs.dry_run }}" == "false" ]]; then
+              crane delete "$img" || true
+              crane delete "$img-dev" || true
+            else
+              echo "DRY RUN: crane delete $img || true"
+              echo "DRY RUN: crane delete $img-dev || true"
+            fi
+          done

.github/workflows/withdraw-repos.yaml

@@ -0,0 +1,34 @@
+on:
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        type: boolean
+        default: 'true'
+        description: If true, just log
+
+permissions:
+  contents: read
+
+jobs:
+  withdraw:
+    runs-on: ubuntu-latest
+    permissions:
+      id-token: write
+      contents: read
+    steps:
+      - uses: step-security/harden-runner@f086349bfa2bd1361f7909c78558e816508cdc10 # v2.8.0
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4
+      - uses: chainguard-dev/setup-chainctl@4c4c132b7b1dd7c9283ff5331e3190ecf9a35755 # v0.1.1
+        with:
+          identity: 720909c9f5279097d847ad02a2f24ba8f59de36a/b6461e99e132298f
+      - run: |
+          for repo in $(grep -v '\#' withdrawn-repos.txt); do
+            if [[ "${{ github.event.inputs.dry_run }}" == "false" ]]; then
+              chainctl image repo rm $repo || true
+            else
+              echo "DRY RUN: chainctl image repo rm $repo || true"
+            fi
+          done