Skip to content

fix: add package permissions to push to GHCR #775

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
skevetter merged 1 commit into from
Jul 27, 2026
+1 −0
Merged

fix: add package permissions to push to GHCR #775

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .github/workflows/publish-agent-helper.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,6 +28,7 @@ jobs:
runs-on: ubuntu-latest
permissions:
contents: read
packages: write

@coderabbitai coderabbitai Bot Jul 27, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Repo files matching workflow:"
git ls-files .github/workflows | sed -n '1,120p'

echo
echo "Target workflow:"
if [ -f .github/workflows/publish-agent-helper.yml ]; then
  nl -ba .github/workflows/publish-agent-helper.yml | sed -n '1,120p'
else
  echo "missing .github/workflows/publish-agent-helper.yml"
fi

echo
echo "Search for create-github-app-token usages and package-related permissions/workflows:"
rg -n "create-github-app-token|permission-packages|packages:\s*write|packages: write|docker/login-action|secrets\.DEVSY_GITHUB_APP|DEVSY_GITHUB_APP" .github . git ls-files 2>/dev/null || true

Repository: devsy-org/devsy

Length of output: 634

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Target workflow:"
sed -n '1,140p' .github/workflows/publish-agent-helper.yml

echo
echo "Search for create-github-app-token usages and package-related permissions/workflows:"
rg -n "create-github-app-token|permission-packages|packages:\s*write|packages: write|docker/login-action|secrets\.DEVSY_GITHUB_APP|DEVSY_GITHUB_APP" .github . 2>/dev/null || true

Repository: devsy-org/devsy

Length of output: 5748

🌐 Web query:

actions/create-github-app-token v3 permission-packages input GitHub App token packages permission

💡 Result:

In the actions/create-github-app-token v3 action, the permission-packages input is used to explicitly define the level of permission granted to the resulting installation access token regarding GitHub Packages [1]. By setting permission-packages, you can control the scope of the token for packages published to GitHub Packages. The valid values for this input are read or write [1]. Key details regarding the use of permission-inputs: - Purpose: By default, if no permission- inputs are specified, the generated token inherits all permissions currently granted to the GitHub App installation [2][3]. It is a recommended best practice to explicitly list only the permissions required for your specific workflow use case to follow the principle of least privilege [2][4]. - Syntax: To set a permission, you prefix the desired GitHub permission key with permission- (e.g., permission-packages) [2][3]. - Constraints: The permissions you request via these inputs must already be granted to your GitHub App installation [4][5]. If you attempt to request a permission that the app does not have, the action will fail [6][4]. Note that installation-level permissions are set when the app is installed, and if you modify the app's permissions later, an administrator must approve the new permissions before they take effect on the installation [2][5]. - Implementation: Internally, the action maps these inputs (e.g., INPUT_PERMISSION-PACKAGES) to the corresponding GitHub API permission scopes (e.g., packages) [6][3].

Citations:

🌐 Web query:

GitHub documentation GitHub App installation tokens permissions packages write create token permission permissions packages: write

💡 Result:

GitHub Apps can be granted a packages permission with read or write access [1]. However, there is a critical distinction between the permissions GitHub Apps can be granted and the functional support for those permissions when authenticating with an installation access token against GitHub Packages registries [2][3]. While the GitHub API allows you to assign packages:write permissions to a GitHub App [1], GitHub App installation access tokens are generally not supported for authenticating directly with GitHub Packages registries (such as npm, Maven, or the GitHub Container Registry) [3]. Attempts to use an installation access token to authenticate with these registries often result in authentication errors (e.g., 401 Unauthorized), as these registries typically require a personal access token (PAT) or a GitHub Actions token [2][3]. The permissions available to GitHub Apps for the REST API include: - Packages (read/write): Controls access to REST API endpoints for managing package metadata, such as listing versions or deleting packages [4][1]. - Note: This permission does not grant the app the ability to perform standard package operations like npm install or docker push against the registries [3]. For workflows involving GitHub Packages, the recommended approach is to use a personal access token (classic) with the appropriate scopes (read:packages, write:packages, delete:packages) [2] or a GitHub Actions token within a workflow environment [3]. If you are building an integration that interacts with package metadata via the REST API, you may be able to use the installation access token, provided the app has the required repository or organization-level permissions [4][1].

Citations:

Use GITHUB_TOKEN for the GHCR push.

The packages: write entry only applies to GITHUB_TOKEN, and the app token generated here does not inherit job permissions.packages; its packages capability also comes from the GitHub App installation, not GITHUB_TOKEN. Switch docker/login-action to GITHUB_TOKEN, or keep the App-token flow and ensure permission-packages: write is both requested and granted on the installation.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-agent-helper.yml at line 31, Update the GHCR
authentication flow in the publish workflow to use GITHUB_TOKEN with the job’s
packages: write permission for docker/login-action; alternatively, if retaining
the GitHub App token flow, request and verify permission-packages: write for the
installation.

steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7

Expand Down
Loading