Using GitHub Packages with GitHub Apps

[hamuyuuki]

I’d like to manage a private RubyGems on GitHub Packages. And I’d like to use a personal access token or GitHub Apps’s token(installation access token) to authenticate.

I could use a personal access token to authenticate. But i couldn’t use GitHub Apps’s token(installation access token). I explain here how to try.

1. Create GitHub Apps with Packages (read and write access level) of Repository permissions.
2. Install GitHub Apps to a repository that managing a private RubyGems.
3. Generate GitHub Apps’s token(installation access token) with a private key.

• ref: https://docs.github.com/en/developers/apps/authenticating-with-github-apps#authenticating-as-an-installation

4. Fetch a private RubyGems from a repository with GitHub Apps’s token(installation access token).

GitHub Docs explains to use GitHub Packages with a personal access token to authenticate. But I didn’t find about using GitHub Packages with GitHub Apps.

Can i use GitHub Packages with GitHub Apps now?

Thank you.

[jcansdale]

hamuyuuki:

Can i use GitHub Packages with GitHub Apps now?

GitHub Packages doesn’t currently support GitHub App tokens. The only exception is the default GitHub Actions token, which is a special kind of app token. For the moment, you will need to use a PAT for programmatic access.

Regards,
Jamie.

[konstantinj]

Still seems to be an issue, at least for me.

[perok]

What does the "packages" permissions actually allow per now given that it can't access packages? 🤔

[Omar-Gebal]

@renan-alm Did you happen to find the answer to that ?

[renan-alm]

@Omar-Gebal no change. Packages only supports authentication using a PAT sadly.

[Omar-Gebal]

@renan-alm RIP, thanks for the reply, Also I found this if you're still curious. Looks like they will add support for it but it still isn't implemented

[hamuyuuki]

Thank you for answering. I understand 😃

[singhprd]

It would be great if adding package support to apps was considered as an improvement.

At the moment to get packages access to a ruby gem for example you need:

• a GitHub user
• a Personal Access Token (classic) - fine grained is not supported yet

Allowing a GitHub app to create tokens for package access would mean you:

• don't need a machine user/to overload a user with a PAT
• could cycle the access token programmatically

Thanks!

[stekern]

Any updates to this? This (and GitHub Packages support for fine-grained PATs, which I assume is related) is sorely needed functionality.

GitHub applications like Renovate are blocked from working seamlessly with GitHub Packages and today require the use of user-associated, classic personal access tokens to fetch package information from GitHub Packages.

[AllexVeldman]

I was able to get Renovate to use a GITHUB_TOKEN to authenticate to ghcr.io.
It does require you to self-host Renovate.

I wrote a small description as part of a sideproject of mine: https://github.com/AllexVeldman/pyoci?tab=readme-ov-file#renovate--ghcrio

[behluluysal]

Is PATs still the only option to use GitHub Packages?

[azlam-abdulsalam]

Any updates on this?

[enniobolondi]

Any news?

[russovincenzo]

It's a bug or not? Why deny access to packages with app token ?

[joluizquierdo]

I tested it myself today, GitHub App installation tokens aren't supported, can you please update on this?

Thank you!!!

[238alexg]

Similar to folks above, I was very confused by this. I was swapping my CICD from using my own personal access token to use GitHub App tokens. PAT obviously isn't great for CICD because it requires sharing personal credentials.

The messaging I kept getting back from a docker push command was also misleading:

permission_denied: installation not allowed to Write organization package

This was very confusing and had be quadruple checking app permissions, installs, and package settings to try and figure out what was preventing access. Looking online wasn't very helpful either as the GitHub docs indicate how to set up GitHub Actions access for this flow, but none explicitly mentioned that you couldn't use a GitHub App token so outside of GH actions.

This all felt pretty bad, and is probably going to result in me moving my images elsewhere.

[renan-alm]

@238alexg, we are all in the same boat when it comes to GH Apps, but a quick input on your issue: A Fine-Grained Token can be owned by an Organization (Classic PATs don't have that feature) which can be a little better than actual personal ones. Not sure you knew it but it might help your scenario.

[238alexg]

Thanks @renan-alm! Not sure how I didn't know about organization fine grained tokens but that will work for my use case 😎

I am still using a GitHub app for some other things and it would be nice to leverage the same credentials for this, but at least I can use your suggestion to solve my issue with packages 🙏

[thegrumpylion]

@renan-alm didn't know that, thanks for sharing. still, there is no packages permissions for fine-grained tokens.