feat(api): add PurgeUnused RPC for bulk-deleting unused workflow contracts

app/cli/cmd/workflow_contract_delete.go

@@ -1,5 +1,5 @@
 //
-// Copyright 2024 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -16,17 +16,35 @@
 package cmd
 
 import (
+	"errors"
+
 	"github.com/chainloop-dev/chainloop/app/cli/pkg/action"
 	"github.com/spf13/cobra"
 )
 
 func newWorkflowContractDeleteCmd() *cobra.Command {
 	var name string
+	var purgeUnused bool
 
 	cmd := &cobra.Command{
 		Use:   "delete",
 		Short: "Delete a contract",
-		RunE: func(cmd *cobra.Command, args []string) error {
+		PreRunE: func(_ *cobra.Command, _ []string) error {
+			if !purgeUnused && name == "" {
+				return errors.New("either --name or --purge-unused must be provided")
+			}
+			return nil
+		},
+		RunE: func(_ *cobra.Command, _ []string) error {
+			if purgeUnused {
+				n, err := action.NewWorkflowContractPurgeUnused(ActionOpts).Run()
+				if err != nil {
+					return err
+				}
+				logger.Info().Int32("count", n).Msg("unused contracts purged")
+				return nil
+			}
+
 			if err := action.NewWorkflowContractDelete(ActionOpts).Run(name); err != nil {
 				return err
 			}
@@ -36,8 +54,8 @@ func newWorkflowContractDeleteCmd() *cobra.Command {
 	}
 
 	cmd.Flags().StringVar(&name, "name", "", "contract name")
-	err := cmd.MarkFlagRequired("name")
-	cobra.CheckErr(err)
+	cmd.Flags().BoolVar(&purgeUnused, "purge-unused", false, "delete all contracts with no associated workflows")
+	cmd.MarkFlagsMutuallyExclusive("name", "purge-unused")
 
 	return cmd
 }

app/cli/pkg/action/workflow_contract_purge_unused.go

@@ -0,0 +1,41 @@
+//
+// Copyright 2026 The Chainloop Authors.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package action
+
+import (
+	"context"
+
+	pb "github.com/chainloop-dev/chainloop/app/controlplane/api/controlplane/v1"
+)
+
+type WorkflowContractPurgeUnused struct {
+	cfg *ActionsOpts
+}
+
+func NewWorkflowContractPurgeUnused(cfg *ActionsOpts) *WorkflowContractPurgeUnused {
+	return &WorkflowContractPurgeUnused{cfg}
+}
+
+func (action *WorkflowContractPurgeUnused) Run() (int32, error) {
+	client := pb.NewWorkflowContractServiceClient(action.cfg.CPConnection)
+	resp, err := client.PurgeUnused(context.Background(), &pb.WorkflowContractServicePurgeUnusedRequest{})
+	if err != nil {
+		action.cfg.Logger.Debug().Err(err).Msg("making the API request")
+		return 0, err
+	}
+
+	return resp.GetTotalPurged(), nil
+}

app/controlplane/api/controlplane/v1/workflow_contract.proto

@@ -1,5 +1,5 @@
 //
-// Copyright 2024-2025 The Chainloop Authors.
+// Copyright 2024-2026 The Chainloop Authors.
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -30,6 +30,7 @@ service WorkflowContractService {
   rpc Describe(WorkflowContractServiceDescribeRequest) returns (WorkflowContractServiceDescribeResponse);
   rpc Delete(WorkflowContractServiceDeleteRequest) returns (WorkflowContractServiceDeleteResponse);
   rpc Apply(WorkflowContractServiceApplyRequest) returns (WorkflowContractServiceApplyResponse);
+  rpc PurgeUnused(WorkflowContractServicePurgeUnusedRequest) returns (WorkflowContractServicePurgeUnusedResponse);
 }
 
 message WorkflowContractServiceListRequest {}
@@ -116,6 +117,12 @@ message WorkflowContractServiceDeleteRequest {
 
 message WorkflowContractServiceDeleteResponse {}
 
+message WorkflowContractServicePurgeUnusedRequest {}
+
+message WorkflowContractServicePurgeUnusedResponse {
+  int32 total_purged = 1;
+}
+
 message WorkflowContractServiceApplyRequest {
   // Raw representation of the contract in json, yaml or cue
   bytes raw_schema = 1;