ci: implement automatic upgrade of PR deployment (#8876)

.github/workflows/pr-cleanup.yaml

@@ -1,7 +1,7 @@
 name: Cleanup PR deployment and image
 on:
   pull_request:
-    types: [closed]
+    types: closed
   workflow_dispatch:
     inputs:
       pr_number:
@@ -63,5 +63,11 @@ jobs:
           (
             curl -X DELETE "https://api.cloudflare.com/client/v4/zones/${{ secrets.PR_DEPLOYMENTS_ZONE_ID }}/dns_records/$record_id" \
             -H "Authorization: Bearer ${{ secrets.PR_DEPLOYMENTS_CLOUDFLARE_API_TOKEN }}" \
-            -H "Content-Type:application/json"
+            -H "Content-Type:application/json" | jq -r '.success'
           ) || echo "DNS record not found"
+
+      - name: "Delete certificate"
+        if: ${{ github.event.pull_request.merged == true }}
+        run: |
+          set -euxo pipefail
+          kuebctl delete certificate "pr${{ steps.pr_number.outputs.PR_NUMBER }}-tls" -n pr-deployment-certs || echo "certificate not found"