Comments (12)
@marksalpeter no problem at all!
You are exactly correct. At the end of the day this seems to be a permissions issue with the default GITHUB_TOKEN
they provide in Actions. I was not able to successfully push images to ghcr.io
using this token because it lacks "create organization package" permissions. I have not been unable to find a bug report or suggestion that GitHub might change their permissions scheme for this token.
So essentially you're faced with two solutions:
- Using the default
GITHUB_TOKEN
, push the image to the repo level withdocker.pkg.github.com
- Add your own personal access token as a secret and push the image to the org level with
ghcr.io
from docker-build-push.
Hi @marksalpeter - thanks for the kind words!
If I understand your use case properly, this is certainly possible. Can you share the snippet of your workflow .yaml
file with the Docker build config? Does this repo live in your personal GitHub (marksalpeter)? Is this also where you want the resulting Docker image to end up?
from docker-build-push.
Hi @mr-smithers-excellent! Thanks for taking the time.
My repo lives on my personal GitHub account (marksalpeter) and, yes, I'd like the resulting image to end up on my personal account as well. Here's the cd workflow so far in its entirety:
name: cd
on:
pull_request:
types: [closed]
branches: [main]
jobs:
version:
runs-on: ubuntu-latest
if: github.event_name == 'pull_request' && github.event.pull_request.merged == true
steps:
- name: Checkout Repo
uses: actions/checkout@v2
- name: Increment Version + Generate Changelog
id: changelog
uses: TriPSs/conventional-changelog-action@v3
with:
github-token: ${{ secrets.github_token }}
skip-version-file: true
output-file: false
skip-commit: true
- name: Create Release
uses: actions/create-release@v1
env:
GITHUB_TOKEN: ${{ secrets.github_token }}
with:
tag_name: ${{ steps.changelog.outputs.tag }}
release_name: ${{ steps.changelog.outputs.tag }}
body: ${{ steps.changelog.outputs.clean_changelog }}
- name: Docker Build & Push
uses: mr-smithers-excellent/docker-build-push@v5
with:
image: marksalpeter/golang-microservice-boilerplate
tags: ${{ steps.changelog.outputs.tag }}, latest
registry: ghcr.io
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
from docker-build-push.
@marksalpeter - thanks, I've finally figured this out through adding some e2e tests (forthcoming). Currently, I'm expecting the GHCR url to be docker.pkg.github.com
, not ghcr.io
. Can you try switching your registry param to that?
I fully realize that's what's in the docs, so I'll be ensuring that works in a new release with e2e tests this evening. Stay tuned.
from docker-build-push.
At some point since I added GitHub Docker registry support, GitHub migrated to a new container registry. I've been able to patch the v5
code to support both legacy docker.pkg.github.com
and new ghcr.io
images.
The key difference between the two is where your images reside. For example:
- Docker registry - docker.pkg.github.com/OWNER/REPOSITORY/IMAGE_NAME (lives at repo level)
- Container registry - ghcr.io/OWNER/IMAGE_NAME (lives at org level)
I've added e2e tests and updated examples for both scenarios, if you'd like to consider both options. One key thing to keep in mind, I was only able to push to ghcr.io
using a custom personal access token. The default one provided in the workflow (secrets.GITHUB_TOKEN
) does not seem to have the needed permissions to create a package at the organizational level.
from docker-build-push.
Same issue
from docker-build-push.
@laopaoer-wallet - can you provide a snippet of your config?
from docker-build-push.
@mr-smithers-excellent Thanks for getting to the bottom of this!
I think the new container registry pattern looks good to me. I canβt imagine needing more than one container per repo and I could easily make a parallel naming structure that would satisfy my OCD π.
The need for a custom key must be at least part of the reason why I wasnβt able to push before. Is that a bug on GitHubβs end? If I recall correctly, their docs seem to suggest that secrets.GITHUB_TOKEN
has permission to push.
Anyway Iβll try the patch first thing tomorrow. Thanks again for all the hard work ππ»
from docker-build-push.
A quick update about the GITHUB_TOKEN
debacle. They seem to be planning to release a patch that enables workflow token support for ghcr.io mid march according to this thread:
https://github.community/t/how-to-use-installation-access-token-in-ghcr-io-authorization/130666/13
from docker-build-push.
Super helpful. Hard to navigate those forums - good find!
from docker-build-push.
Yea, I left a comment about that on the thread π
from docker-build-push.
So, I'm going to close this ticket. I think it's resolved as it can be for now. Thanks for all the help @mr-smithers-excellent π
from docker-build-push.
Related Issues (20)
- Set output warning when running this action HOT 7
- Github action Error: Dockerfile does not exist in location Dockerfile HOT 8
- Build The `set-output` command is deprecated and will be disabled soon. Please upgrade to using Environment Files. HOT 7
- Docker Push without build HOT 2
- Support for pull_request event
- Support for pull_request event HOT 6
- Output image SHA256 digest(s) HOT 4
- ERROR: failed to solve: Internal: header key "exclude-patterns" contains value with non-printable ASCII characters HOT 3
- Why is my organization's name a secret? HOT 1
- How do I find the correct registry and image name to use? HOT 2
- Any plan to support Azure Container Registries? HOT 4
- Exit Code 1 after pushing latest tag HOT 1
- Is it possible to cache node_modules that were installed in Dockerfile? HOT 1
- "Node.js 16 actions are deprecated" warning HOT 1
- Action fails pipeline if credentials are not supplied HOT 9
- Not working with Artifact Registry HOT 2
- Conditionally Setting `addLatest` does not work for truthy values HOT 1
- Why is there no switch to set whether to push all tags? HOT 4
- Input multiPlatform is set to true, skipping Docker push step HOT 2
- How to push latest tag only upon releases HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
π Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. πππ
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google β€οΈ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from docker-build-push.