GITHUB_TOKEN permission denied write package when build and push docker in github workflows

Question

I have a Github organization and try to migrate container registry from docker hub to GitHub Packages. By using Github Workflows, here's the yaml I used to push docker to GitHub Packages:

name: ghcr_test
on:
  push:
    branches:
      - dev

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Login to GitHub Packages
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

GitHub recommends using GITHUB_TOKEN in action workflows, I'm already double check it has read and write permission in my organization settings, but they gave me this error

Error: buildx failed with: error: denied: permission_denied: write_package

Any help?

Answer 1

I think you might need to do two things here:

• First of all, ensure that the Package settings (bottom right of the package page) allow access to actions running in the repository in question
• Secondly, ensure that you have added the package permission to your job

The second of these involves adding this snippet to your workflow's job (note that this permission can be read if you are only pulling a container):

    permissions:
      packages: write

In the context of your workflow:

name: ghcr_test
on:
  push:
    branches:
      - dev

jobs:
  deploy:
    runs-on: ubuntu-latest
    permissions:
      packages: write
    steps:
      - name: Checkout
        uses: actions/checkout@v2
      - name: Login to GitHub Packages
        uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - name: Build and push Docker image
        uses: docker/build-push-action@v2
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}:${{ github.sha }}

I had a similar issue and eventually stumbled across that permission and suddenly everything started to work. Hopefully it will for you too.