GitHub Community
Pulling from ghcr.io via app installation tokens is broken #171423
Replies: 9 comments 9 replies
|
💬 Your Product Feedback Has Been Submitted 🎉 Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users. Here's what you can expect moving forward ⏩
Where to look to see what's shipping 👀
What you can do in the meantime 💻
As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities. Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐ |
|
At the moment, the packages:read permission for GitHub Apps does not grant access to pull images from GHCR. This isn’t just you — it’s a current platform limitation. Even though you can mint an installation access token with "packages": "read", GHCR does not yet accept GitHub App installation tokens for authentication. That’s why your docker login appears to succeed but docker pull fails with denied. Workarounds: Use a Personal Access Token (classic) Generate a PAT with at least the read:packages scope (and repo if the package is private). Log in with: If using GitHub Actions You can pull from GHCR using the workflow’s GITHUB_TOKEN (with packages: read permission set in the workflow file). Example: |
|
Hi All, I just ran through the exact same issue with my homelab and have been trying to avoid PAT though unfortunately I now have to use PAT due to the limitations. I was wondering if anyone knows when the limitation will be fixed? |
|
Hi, Any news? |
|
@walid-khalafi We just want our Octopus Instance to pull images that are pushed to GitHub Container Registry during the deploy. |
|
It's frustrating that I can't use GitHub apps to do that. |
|
Is there a public issue that we can comment on to express our desire for this to be resolved? Is it on a roadmap? Does anyone at Github actually care? |
This comment was marked as spam.
This comment was marked as spam.
|
I think your message just broke the space-time continuum. Could you translate it into plain English? |
|
@walid-khalafi is there a public bug report that we can watch for this particular issue? ie that "GHCR does not yet accept GitHub App installation tokens for authentication" |
|
Any progress on this? Feels kind of old school to create a personal PAT token for this. We just want our Octopus Instance to pull images deployed to GitHub Container Registry during deploy. |
|
Nearly a year later, the same question as the others. Any update on this? We're trying to move to using app credentials (created by https://github.com/martinbaillie/vault-plugin-secrets-github) in our automation, and our primary use case is needing ghcr pull tokens for our orchestration system. I got everything configured, created the first dynamic token, then hit a wall when the token couldn't actually read packages. |
|
Like everyone else came here to confirm that gh app generated tokens can't authenticate to ghcr - this seems trivial if gh wants to limit PAT |
|
Any progress on this? this is a big limitation to limit access between organizations for a token |
|
Any update? (Obviously the answer is "no" - just here to add my "+1" and express my disappointment that this is apparently not a priority issue.) |
At the moment, the packages:read permission for GitHub Apps does not grant access to pull images from GHCR. This isn’t just you — it’s a current platform limitation.
Even though you can mint an installation access token with "packages": "read", GHCR does not yet accept GitHub App installation tokens for authentication. That’s why your docker login appears to succeed but docker pull fails with denied.
Workarounds:
Use a Personal Access Token (classic)
Generate a PAT with at least the read:packages scope (and repo if the package is private).
Log in with:
echo $PAT | docker login ghcr.io -u GITHUB_USERNAME --password-stdin
This works for both public and private packages.
If using GitHub Actions