Personal Docker Registry

[marksalpeter]

First, thanks for maintaining this excellent package! Its much easier to configure than docker/build-push-action@v2 and I was able to make a ton of progress in a short amount of time with it.

That said, I can't seem to get this to work for my project. I think it has something to do with the repo belonging to my personal account. I don't want to publish to a github organizations registry. Is that possible with this action?

Heres the full log for reference:

Run mr-smithers-excellent/docker-build-push@v5
Docker image name created: ghcr.io/marksalpeter/golang-microservice-boilerplate
Logging into Docker registry ghcr.io...
WARNING! Your password will be stored unencrypted in /home/runner/.docker/config.json.
Building Docker image: ghcr.io/marksalpeter/golang-microservice-boilerplate:v0.3.6
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Sending build context to Docker daemon  152.6kB

Step 1/9 : FROM golang as builder
latest: Pulling from library/golang
0ecb575e629c: Already exists
7467d1831b69: Already exists
feab2c490a3c: Already exists
f15a0f46f8c3: Already exists
1517911a35d7: Pulling fs layer
8e11185b0368: Pulling fs layer
f496c6a12b74: Pulling fs layer
f496c6a12b74: Verifying Checksum
f496c6a12b74: Download complete
1517911a35d7: Verifying Checksum
1517911a35d7: Download complete
8e11185b0368: Verifying Checksum
8e11185b0368: Download complete
1517911a35d7: Pull complete
8e11185b0368: Pull complete
f496c6a12b74: Pull complete
Digest: sha256:f3f90f4d30866c1bdae90012b506bd5e557ce27ccd2510ed30a011c44c1affc8
Status: Downloaded newer image for golang:latest
 ---> 861b1afd1d13
Step 2/9 : ENV CGO_ENABLED=0
 ---> Running in 78b3d69cbcbf
Removing intermediate container 78b3d69cbcbf
 ---> 3b76f4c036e2
Step 3/9 : COPY . /server
 ---> 7ae9670ff586
Step 4/9 : RUN cd /server && go build -o server -v .
 ---> Running in 004fcf040e9b
net
net/textproto
crypto/x509
vendor/golang.org/x/net/http/httpguts
vendor/golang.org/x/net/http/httpproxy
mime/multipart
crypto/tls
net/http/httptrace
net/http
github.com/marksalpeter/golang-microservice-boilerplate
Removing intermediate container 004fcf040e9b
 ---> 7b1ca21276f2
Step 5/9 : FROM alpine:latest
latest: Pulling from library/alpine
ba3557a56b15: Pulling fs layer
ba3557a56b15: Verifying Checksum
ba3557a56b15: Download complete
ba3557a56b15: Pull complete
Digest: sha256:a75afd8b57e7f34e4dad8d65e2c7ba2e1975c795ce1ee22fa34f8cf46f96a3be
Status: Downloaded newer image for alpine:latest
 ---> 28f6e2705743
Step 6/9 : WORKDIR /opt
 ---> Running in ff4369ba4c96
Removing intermediate container ff4369ba4c96
 ---> 7df2c593aafa
Step 7/9 : COPY --from=builder /server/server /opt
 ---> 57b754a52e5c
Step 8/9 : ENTRYPOINT /opt/server
 ---> Running in 9f4b6385ceb1
Removing intermediate container 9f4b6385ceb1
 ---> 7da86c8638eb
Step 9/9 : EXPOSE 8080
 ---> Running in a72b94d6f885
Removing intermediate container a72b94d6f885
 ---> fa749470f28d
Successfully built fa749470f28d
Successfully tagged ghcr.io/marksalpeter/golang-microservice-boilerplate:v0.3.6
Pushing Docker image ghcr.io/marksalpeter/golang-microservice-boilerplate:v0.3.6
The push refers to repository [ghcr.io/marksalpeter/golang-microservice-boilerplate]
c346c899f7e6: Preparing
cb381a32b229: Preparing
denied: installation not allowed to Create organization package, existing permissions: map[actions:write checks:write contents:write deployments:write issues:write metadata:read packages:write pull_requests:write repository_projects:write sarifs:write security_events:write statuses:write]
Error: Command failed: docker push ghcr.io/marksalpeter/golang-microservice-boilerplate:v0.3.6

[mr-smithers-excellent]

Hi @marksalpeter - thanks for the kind words!

If I understand your use case properly, this is certainly possible. Can you share the snippet of your workflow .yaml file with the Docker build config? Does this repo live in your personal GitHub (marksalpeter)? Is this also where you want the resulting Docker image to end up?

[marksalpeter]

Hi @mr-smithers-excellent! Thanks for taking the time.

My repo lives on my personal GitHub account (marksalpeter) and, yes, I'd like the resulting image to end up on my personal account as well. Here's the cd workflow so far in its entirety:

name: cd

on:
  pull_request:
    types: [closed]
    branches: [main]

jobs:
  version:
    runs-on: ubuntu-latest
    if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v2

      - name: Increment Version + Generate Changelog
        id: changelog
        uses: TriPSs/conventional-changelog-action@v3
        with:
          github-token: ${{ secrets.github_token }}
          skip-version-file: true
          output-file: false
          skip-commit: true

      - name: Create Release
        uses: actions/create-release@v1
        env:
          GITHUB_TOKEN: ${{ secrets.github_token }}
        with:
          tag_name: ${{ steps.changelog.outputs.tag }}
          release_name: ${{ steps.changelog.outputs.tag }}
          body: ${{ steps.changelog.outputs.clean_changelog }}

      - name: Docker Build & Push
        uses: mr-smithers-excellent/docker-build-push@v5
        with:
          image: marksalpeter/golang-microservice-boilerplate
          tags: ${{ steps.changelog.outputs.tag }}, latest
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

[mr-smithers-excellent]

@marksalpeter - thanks, I've finally figured this out through adding some e2e tests (forthcoming). Currently, I'm expecting the GHCR url to be docker.pkg.github.com, not ghcr.io. Can you try switching your registry param to that?

I fully realize that's what's in the docs, so I'll be ensuring that works in a new release with e2e tests this evening. Stay tuned.

[mr-smithers-excellent]

At some point since I added GitHub Docker registry support, GitHub migrated to a new container registry. I've been able to patch the v5 code to support both legacy docker.pkg.github.com and new ghcr.io images.

The key difference between the two is where your images reside. For example:

• Docker registry - docker.pkg.github.com/OWNER/REPOSITORY/IMAGE_NAME (lives at repo level)
• Container registry - ghcr.io/OWNER/IMAGE_NAME (lives at org level)

I've added e2e tests and updated examples for both scenarios, if you'd like to consider both options. One key thing to keep in mind, I was only able to push to ghcr.io using a custom personal access token. The default one provided in the workflow (secrets.GITHUB_TOKEN) does not seem to have the needed permissions to create a package at the organizational level.

[laopaoer-wallet]

Same issue

[mr-smithers-excellent]

@laopaoer-wallet - can you provide a snippet of your config?

[marksalpeter]

@mr-smithers-excellent Thanks for getting to the bottom of this!

I think the new container registry pattern looks good to me. I can’t imagine needing more than one container per repo and I could easily make a parallel naming structure that would satisfy my OCD 😂.

The need for a custom key must be at least part of the reason why I wasn’t able to push before. Is that a bug on GitHub’s end? If I recall correctly, their docs seem to suggest that secrets.GITHUB_TOKEN has permission to push.

Anyway I’ll try the patch first thing tomorrow. Thanks again for all the hard work 🙏🏻

[mr-smithers-excellent]

@marksalpeter no problem at all!

You are exactly correct. At the end of the day this seems to be a permissions issue with the default GITHUB_TOKEN they provide in Actions. I was not able to successfully push images to ghcr.io using this token because it lacks "create organization package" permissions. I have not been unable to find a bug report or suggestion that GitHub might change their permissions scheme for this token.

So essentially you're faced with two solutions:

1. Using the default GITHUB_TOKEN, push the image to the repo level with docker.pkg.github.com
2. Add your own personal access token as a secret and push the image to the org level with ghcr.io

[marksalpeter]

A quick update about the GITHUB_TOKEN debacle. They seem to be planning to release a patch that enables workflow token support for ghcr.io mid march according to this thread:
https://github.community/t/how-to-use-installation-access-token-in-ghcr-io-authorization/130666/13

[mr-smithers-excellent]

Super helpful. Hard to navigate those forums - good find!

[marksalpeter]

Yea, I left a comment about that on the thread 😂

[marksalpeter]

So, I'm going to close this ticket. I think it's resolved as it can be for now. Thanks for all the help @mr-smithers-excellent 🙏