Cannot login to ghcr.io

[daenney]

I'm trying to have my goreleaser upload images to ghcr.io. To do that I have:

• configured an image_template with ghcr.io/daenney/{{.ProjectName}}
• Created a secret named GH_PAT with a PAT that has the ability to work with packages, and set that as the GITHUB_TOKEN

Unfortunately, it fails to push with:

The push refers to repository [ghcr.io/daenney/gdqbot]
b3b3f5b6a923: Preparing
fb0113d63c91: Preparing
960cfde826a2: Preparing
denied: unauthenticated: User cannot be authenticated with the token provided.
: exit status 1
Error: The process '/opt/hostedtoolcache/goreleaser-action/0.149.0/x64/goreleaser' failed with exit code 1

I feel like I'm probably missing something incredibly obvious but I'm not sure what.

[daenney]

Oh, I tried to login with the token myself, and that seems to work:

echo "MY_SECRET_TOKEN" | docker login ghcr.io -u docker --password-stdin
WARNING! Your password will be stored unencrypted in /home/daenney/.docker/config.json.
Configure a credential helper to remove this warning. See
https://docs.docker.com/engine/reference/commandline/login/#credentials-store

Login Succeeded

[daenney]

It appears as though I've misunderstood how this was supposed to work together. This works:

    - name: Login to GitHub Container Registry
      uses: docker/login-action@v1
      with:
        registry: ghcr.io
        username: ${{ github.repository_owner }}
        password: ${{ secrets.GH_PAT }}
    - name: Run GoReleaser
      uses: goreleaser/goreleaser-action@v2
      with:
        version: latest
        args: release --rm-dist
      env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

[crazy-max]

@daenney Yes that's it!

[tschaub]

Does the auto-login feature in GoReleaser (goreleaser/goreleaser#1703) change any of this? Or is it still required to run the docker/login-action action before the goreleaser/goreleaser-action (when pushing to ghcr.io)?

[tschaub]

As of today, it looks like these things are true:

1. you don't need to create a personal access token to push to ghcr.io from this action
2. you can use GITHUB_TOKEN, but need to specifically set packages: write in the job/workflow permissions
3. you need to docker login before running this action (e.g. using docker/login-action)

Here is a complete working example release.yml:

name: Release

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write
  packages: write

jobs:
  release:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
        with:
          fetch-depth: 0
      - run: git fetch --force --tags
      - uses: actions/setup-go@v2
        with:
          go-version: 1.18
      - uses: docker/login-action@v1
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}
      - uses: goreleaser/goreleaser-action@v2
        with:
          distribution: goreleaser
          version: latest
          args: release --rm-dist
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}