ci(share): prunes stale share images on a schedule

[seferturan]

🚧 Drafted 🚧

• Show release dates still need sorting. effectiveReleaseDate for shows is first_aired, so a long running show that premiered years ago falls into the slowest tier even while it is actively airing and its ratings churn weekly. trakt-workers uses shows.lastAired for exactly this reason, and last_aired is not on the show summary response, so this needs its own decision
• Wants a dry run before merge. This deletes from walter, so the prefix scoping should be proven against the real bucket first

🎶 Notes 🎶

• Adds a daily job that prunes stale share images so cards get regenerated as their media changes
  • newer releases are pruned more often, because posters and ratings move most inside the release window
  • tiers match AGGRESSIVE_RECHECK_SCHEDULE in trakt-workers: 12h under 14 days, 3d to 40 days, 7d to 120 days, 30d after that
  • the aggressive schedule is the right one here, its own docs cite ratings on newly released media, which is what a card renders
• Scoped to images/share/{og,feed,story}/{movie,show}/, derived from the same helper the endpoint builds paths with, so the prefixes cannot drift from where images actually land
• Reads cachedAt and releasedAt from object metadata
  • parses ISO and falls back to epoch ms, so objects written before the ISO switch still read correctly
  • metadata keys come back lowercased over the S3 API, so both casings are handled
  • objects with no cachedAt are skipped rather than deleted
  • objects with no releasedAt are pruned, so they come back with the full metadata set

🛠 Fixed along the way 🛠

• The egress allowlist would have failed on the first run. It only permitted api.cloudflare.com, but the script talks to <account>.r2.cloudflarestorage.com and setup-deno needs jsr and npm. Copied the proven set from supply_chain.yml and added the R2 host
• Dropped a duplicate checkout, setup-deno already does one
• Split buildTargetPrefixes and shareImagePrefix out of buildImagePath so each file keeps one export
• Spec fixtures were still on the pre move images/og/... prefixes

🤔 Worth knowing 🤔

• One HEAD request per object per run, since the S3 list API does not return custom metadata. Chunked 50 at a time
• Real media images in walter carry no cachedAt, so they are skipped even if a prefix were ever wrong. That is the safety net, not the plan

[deepsource-io]

DeepSource Code Review

We reviewed changes in 4056525...daa55be on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
JavaScript		Aug 18, 2026 11:10a.m.	Review ↗
Code coverage		Aug 18, 2026 11:40a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.