Define cleanup authorization and targets

internal/config/validate_publish.go

@@ -86,6 +86,19 @@ func validatePublish(cfg *PublishConfig, scriptorium *ScriptoriumConfig, notariu
 	return nil
 }
 
+func validateCleanupPublishPolicy(cfg *PipelineConfig) error {
+	if cfg == nil || (!cfg.Spool.DeleteAudioAfterPublish && !cfg.Workspace.CleanupAfterPublish) {
+		return nil
+	}
+	if cfg.Publish == nil || (cfg.Publish.Enabled != nil && !*cfg.Publish.Enabled) {
+		return fmt.Errorf("post-publish cleanup policies require pipeline.publish.enabled=true")
+	}
+	if cfg.Publish.UploadRun != nil && !*cfg.Publish.UploadRun {
+		return fmt.Errorf("post-publish cleanup policies require pipeline.publish.upload_run=true")
+	}
+	return nil
+}
+
 func scriptoriumOutputPathMap(scriptorium *ScriptoriumConfig) map[string]string {
 	out := map[string]string{}
 	if scriptorium == nil || len(scriptorium.Artifacts) == 0 {