PAT creation section: possible incorrect info

[niraj8]

What article on docs.github.com is affected?

This one -> https://docs.github.com/en/free-pro-team@latest/packages/guides/migrating-to-github-container-registry-for-docker-images#authenticating-with-the-container-registry

What part(s) of the article would you like to see updated?

Authenticating with the container registry

The article mentions create a PAT with write:packages but without repo access

This is not possible right now👇

Additional information

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[chiedo]

@niraj8 Thanks for opening an issue! I’ll triage this for the right team to take a look 👀

[thatInfrastructureGuy]

The workaround I used was to create PAT with repo and write:packages permissions. Once the PAT was created I updated the permissions and removed the non-essential repo permissions. I was still able to build and push docker image to ghcr.io registry with the reduced permissions.

---

Update 03/23/21: This workaround is not working anymore. See #2660 (comment)

[dgholz]

Once the PAT was created I updated the permissions and removed the non-essential repo permissions.

I don't see how to edit a PAT's scope once it's created, I can only delete it. How did you remove the permission?

[niraj8]

I don't see how to edit a PAT's scope once it's created, I can only delete it. How did you remove the permission?

Clicking on the title of a token should allow you to edit its scopes
On this page https://github.com/settings/tokens

[giovannidegani]

Now for me even when editing the repo permissions are selected and greyed out.

[amrwc]

Once the PAT was created I updated the permissions and removed the non-essential repo permissions.

I don't see how to edit a PAT's scope once it's created, I can only delete it. How did you remove the permission?

It doesn't work anymore, at least as of today, and the comment above also mentions that it's greyed out:

Now for me even when editing the repo permissions are selected and greyed out.

Screenshot from https://github.com/settings/tokens/<token_id>:

[janiceilene]

👋 Hey folks, if you're having any confusion related to what you're seeing in your individual accounts, you should check in with our wonderful support team!

[reimer-atb]

@janiceilene there is no confusion. The docs state to

deselect the repo scope when creating the PAT.

But this is currently not possible - see screenshot provided above.
Selecting the write:packages scope for a PAT will automatically select the repo scope.
And the repo scope cannot be deselected unless you also deselect the write:packages scope.

According to the docs your PAT needs the write:packages scope to push docker images to the new "improved container registry".

So either the docs are wrong and must be fixed or there is a serious bug in the Create PAT page.

[jmarlena]

Hey all! I confirmed this behavior is new and unexpected. I've surfaced this to the packages engineering team. We can update our docs in the meantime! ❤️

[reimer-atb]

@jmarlena any status update from the packages engineering team? The bug still exists on the Create PAT page. Is there an issue for this, which we can upvote and follow?

Also, the docs still haven't been updated.

[Draya007]

Errors?

[jmarlena]

@philipreimer Sorry for the wait everyone. We have a proposed workaround from the engineering team. I'll follow-up once it's live.

[jmarlena]

Heads up about these workarounds:
A) Use this url https://github.com/settings/tokens/new?scopes=write:packages, which allows you to avoid the automatic repo scope selection in the UI.
B) Now GitHub Container Registry supports using the GITHUB_TOKEN for GitHub Actions workflows so you don't have to use a PAT in a workflow anymore to push docker images to ghcr.io anymore.