dotnet restore in Github Actions gives 401 unauthorized

Question

a NET6 project on GitHub cannot be dotnet-restored in GitHub Actions. dotnet restore works fine locally. Looking at the Action logs, it seems GH looks for Microsoft dependencies in my GitHub Packages Repo. System.Linq is MS-stuff.

  Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/mdddev/download/system.linq/index.json'.
  Response status code does not indicate success: 401 (Unauthorized).
/home/runner/.dotnet/sdk/6.0.202/NuGet.targets(130,5): warning : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured. [/home/runner/work/meh/meh/meh.sln]

Further below in the pipeline there is a step to publish the result to the GitHub Packages registry, however in the project itself I am only using public NuGet references. I am not sure why GH Actions looks for the .NET stuff in my registry. I even have the public NuGet feed configured in my nuget.config:

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <clear />
        <add key="nuget" value="https://api.nuget.org/v3/index.json" />
        <add key="github" value="https://nuget.pkg.github.com/mdddev/index.json" />
    </packageSources>
</configuration>

Does anyone know what's the problem here?

Answer 1

If you are using GITHUB_TOKEN for automatic authentication you should know that you must explicitly give view permissions PER PACKAGE, PER REPOSITORY! So if you have a large volume of internal libraries you want to pull in to your solution you have to go in to each one and allow each package to be used by your new solution.

This takes a surprisingly large number of clicks in a large code base. I certainly hope they improve this process by granting permissions on an organization level for shared libraries, a bulk select, or command line way of granting permissions en masse.

Ensuring workflow access to your package