GITHUB_TOKEN permissions for ghcr.io only apply to the default branch

Describe the bug When using the GITHUB_TOKEN to pull images from our private ghcr.io registry following these instructions, it only works on the default branch of each repository with access to the image.

This makes it that I can’t use our images as part of a pull_request workflow using the GITHUB_TOKEN.

To Reproduce Steps to reproduce the behavior:

1. Push a docker image to an organisation ghcr.io registry
2. Add the repository you want to have read access for to the package Actions Access in it’s Package Settings
3. In that repository define a workflow that triggers on pull_request that pulls the image from step 1 using the GITHUB_TOKEN
4. Create a PR.

Expected behavior I expect the image to be able to be pulled from any branch in the repository i gave permissions to.

Runner Version and Platform

Cloud hosted ubuntu-latest

What’s not working?

Login Succeeded
Error response from daemon: pull access denied for ghcr.io/<org>/<image>, repository does not exist or may require 'docker login': denied: installation not allowed to Read organization package

Job Log Output

Output when trying to pull as a service:

Starting foobar service container
  /usr/bin/docker --config /home/runner/work/_temp/.docker_d81b48f1-4348-4e54-ab6b-a314fb1605f4 login ghcr.io -u AllexVeldman --password-stdin
  /usr/bin/docker --config /home/runner/work/_temp/.docker_d81b48f1-4348-4e54-ab6b-a314fb1605f4 pull ghcr.io/<org>/<image>:latest
  Error response from daemon: pull access denied for ghcr.io/<org>/<image>, repository does not exist or may require 'docker login': denied: installation not allowed to Read organization package
  Warning: Docker pull failed with exit code 1, back off 4.111 seconds before retry.
  /usr/bin/docker --config /home/runner/work/_temp/.docker_d81b48f1-4348-4e54-ab6b-a314fb1605f4 pull ghcr.io/<org>/<image>:latest
  Error response from daemon: pull access denied for ghcr.io/<org>/<image>, repository does not exist or may require 'docker login': denied: installation not allowed to Read organization package
  Warning: Docker pull failed with exit code 1, back off 3.738 seconds before retry.
  /usr/bin/docker --config /home/runner/work/_temp/.docker_d81b48f1-4348-4e54-ab6b-a314fb1605f4 pull ghcr.io/<org>/<image>:latest
  Error response from daemon: pull access denied for ghcr.io/<org>/<image>, repository does not exist or may require 'docker login': denied: installation not allowed to Read organization package
  Error: Docker pull failed with exit code 1

Output when run as a step:

Run echo "***" | docker login ghcr.io --username AllexVeldman --password-stdin
WARNING! Your password will be stored unencrypted in /home/runner/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded
Error response from daemon: pull access denied for ghcr.io/<org>/<image>, repository does not exist or may require 'docker login': denied: installation not allowed to Read organization package

[jonashackt]

The error seems to be fixed now!

But nevertheless you need to follow the instructions @AllexVeldman mentioned (https://docs.github.com/en/packages/guides/using-github-packages-with-github-actions#upgrading-a-workflow-that-accesses-ghcrio):

• head over to your GitHub (orga) profile’s package overview
• go to the package/container image you want to build inside Actions
• scroll to Manage Actions access
• add the repo and finally configure Role to write.

This will make your Actions/Runner be able to read and publish your image to the GitHub Container Registry - also from PR branches (no need for a PAT anymore here also)!

[hross]

This isn’t specific to the runner so I’m going to close this issue but I did add this to an internal issue we have tracking this problem and someone will follow up here when it is fixed (this appears to be a bug).