Using GitHub Packages with GitHub Apps

[hamuyuuki]

I’d like to manage a private RubyGems on GitHub Packages. And I’d like to use a personal access token or GitHub Apps’s token(installation access token) to authenticate.

I could use a personal access token to authenticate. But i couldn’t use GitHub Apps’s token(installation access token). I explain here how to try.

1. Create GitHub Apps with Packages (read and write access level) of Repository permissions.
2. Install GitHub Apps to a repository that managing a private RubyGems.
3. Generate GitHub Apps’s token(installation access token) with a private key.

• ref: https://docs.github.com/en/developers/apps/authenticating-with-github-apps#authenticating-as-an-installation

4. Fetch a private RubyGems from a repository with GitHub Apps’s token(installation access token).

GitHub Docs explains to use GitHub Packages with a personal access token to authenticate. But I didn’t find about using GitHub Packages with GitHub Apps.

Can i use GitHub Packages with GitHub Apps now?

Thank you.

[jcansdale]

hamuyuuki:

Can i use GitHub Packages with GitHub Apps now?

GitHub Packages doesn’t currently support GitHub App tokens. The only exception is the default GitHub Actions token, which is a special kind of app token. For the moment, you will need to use a PAT for programmatic access.

Regards,
Jamie.

[perok]

What does the "packages" permissions actually allow per now given that it can't access packages? 🤔

[Omar-Gebal]

@renan-alm Did you happen to find the answer to that ?

[renan-alm]

@Omar-Gebal no change. Packages only supports authentication using a PAT sadly.

[Omar-Gebal]

@renan-alm RIP, thanks for the reply, Also I found this if you're still curious. Looks like they will add support for it but it still isn't implemented

[Radiergummi]

Oh my. This is so disappointing. Using PATs is such a bad option for companies - employee-bound tokens embedded in IaC or Actions secrets are nothing but ticking time-bombs. At some point an employee is going to leave, or worse, has to be fired due to trust issues.
Now you're in for a hunt: Did you really replace all tokens? Will any infrastructure component fail due to an unexpected Access Denied error?
The alternative is to have a bot account exclusively used to hold personal access tokens, but having to pay for an extra seat just to cover for GitHub's awful product choices and forever-dangling roadmap items makes me really angry.

[hamuyuuki]

Thank you for answering. I understand 😃

[singhprd]

It would be great if adding package support to apps was considered as an improvement.

At the moment to get packages access to a ruby gem for example you need:

• a GitHub user
• a Personal Access Token (classic) - fine grained is not supported yet

Allowing a GitHub app to create tokens for package access would mean you:

• don't need a machine user/to overload a user with a PAT
• could cycle the access token programmatically

Thanks!

[stekern]

Any updates to this? This (and GitHub Packages support for fine-grained PATs, which I assume is related) is sorely needed functionality.

GitHub applications like Renovate are blocked from working seamlessly with GitHub Packages and today require the use of user-associated, classic personal access tokens to fetch package information from GitHub Packages.

[AllexVeldman]

I was able to get Renovate to use a GITHUB_TOKEN to authenticate to ghcr.io.
It does require you to self-host Renovate.

I wrote a small description as part of a sideproject of mine: https://github.com/AllexVeldman/pyoci?tab=readme-ov-file#renovate--ghcrio

[behluluysal]

Is PATs still the only option to use GitHub Packages?

[azlam-abdulsalam]

Any updates on this?

[enniobolondi]

Any news?

[russovincenzo]

It's a bug or not? Why deny access to packages with app token ?

[joluizquierdo]

I tested it myself today, GitHub App installation tokens aren't supported, can you please update on this?

Thank you!!!

[238alexg]

Similar to folks above, I was very confused by this. I was swapping my CICD from using my own personal access token to use GitHub App tokens. PAT obviously isn't great for CICD because it requires sharing personal credentials.

The messaging I kept getting back from a docker push command was also misleading:

permission_denied: installation not allowed to Write organization package

This was very confusing and had be quadruple checking app permissions, installs, and package settings to try and figure out what was preventing access. Looking online wasn't very helpful either as the GitHub docs indicate how to set up GitHub Actions access for this flow, but none explicitly mentioned that you couldn't use a GitHub App token so outside of GH actions.

This all felt pretty bad, and is probably going to result in me moving my images elsewhere.

[renan-alm]

@238alexg, we are all in the same boat when it comes to GH Apps, but a quick input on your issue: A Fine-Grained Token can be owned by an Organization (Classic PATs don't have that feature) which can be a little better than actual personal ones. Not sure you knew it but it might help your scenario.

[238alexg]

Thanks @renan-alm! Not sure how I didn't know about organization fine grained tokens but that will work for my use case 😎

I am still using a GitHub app for some other things and it would be nice to leverage the same credentials for this, but at least I can use your suggestion to solve my issue with packages 🙏

[thegrumpylion]

@renan-alm didn't know that, thanks for sharing. still, there is no packages permissions for fine-grained tokens.

[utkarsh-um]

@238alexg @thegrumpylion was either of you able to use "organization fine grained tokens" for packages?

[tinhlhm-fgs]

any update?

[andremarcelotanner-cohere]

Hello from 2026, still not supported :)

[joaosa]

and another hello :). having this would be great!

[celoprd]

Hello, crazy that after almost 6 years. Is it possible to ping someone from github on this ? I mean, mark the discussion as answered does not mean that problem is solved no ?

[Nikita-Guchakov]

Same here, still not supported and still needed. GITHUB_TOKEN is not an option here, because we need to provide CI access to another repository of our organization

[keidyz]

Funny how every 2 years or so, I always end up trying to use gh apps for packages but then get stunned when it doesn't work and then I end up remembering that it really isn't supported.

It's been 6 years now since this discussion opened- now I'm just stunned that it hasn't been fixed yet.

[CpuID]

This would be extremely useful to have implemented, pity its sitting with so much interest for so long :(

[Parth-Sabhadiya-Imprivata]

It would be great to have GH apps to use GH packages. I did all option try with GH app permission on the package, but it says denied