Is it possible to create public GitHub packages by default for OSS projects?

[ethan42]

Hello!

I am part of a team creating content for OSS developers and are trying to provide them with GitHub action workflows that “just work”. However, we have stumbled on a roadblock. Imagine that we have a simple GitHub action as follows:

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}
jobs:

build:

name: '${{ matrix.os }} shared=${{ matrix.shared }} ${{ matrix.build_type }}'

runs-on: ${{ matrix.os }}

strategy:

matrix:

os: [ubuntu-latest]

shared: [false]

build_type: [Release]

include:

- os: ubuntu-latest

triplet: x64-linux
steps:
  - uses: actions/checkout@v2

  - name: Log in to the Container registry
    uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
    with:
      registry: ${{ env.REGISTRY }}
      username: ${{ github.actor }}
      password: ${{ secrets.GITHUB_TOKEN }}

  - name: Extract metadata (tags, labels) for Docker
    id: meta
    uses: docker/metadata-action@98669ae865ea3cffbcbaa878cf57c20bbf1c6c38
    with:
      images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}

  - name: Build and push Docker image
    uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
    with:
      context: .
      push: true
      tags: ${{ steps.meta.outputs.tags }}
      labels: ${{ steps.meta.outputs.labels }}

Nothing special above (and we love that!), you build your image (say ethan42/oss) and then you proceed to push it with your GITHUB_TOKEN to ghcr.io (ghcr.io/ethan42/oss) and copy-pasting this action to your github project “just works”, correctly pushing your image under your packages. However, now image that this is an open source project and we would like the image we create to be public. This is technically possible through multiple steps that are well hidden within the documentation, but it definitely takes us away from the “copy-paste your action and it just works” mentality. We have been unable to find an option to tweak the default visibility for such packages or even update it through APIs during the GitHub action.

So, is anyone aware of a way to create public images within ghcr.io by default? Or perhaps a project setting that enables you to do that?

Thank you for the time!

[queenofcorgis]

Welcome to the community, @ethan42 🎉 I’ve recategorized your post to our Actions subcategory so it will get better visibility among those able to assist :slight_smile:

[ethan42]

I was able to find a solution through GitHub’s excellent support channel, so posting here in case someone else is interested:

When a container package is published using the built-in GitHub Actions workflow token ( ${{ secrets.GITHUB_TOKEN }} ), the published package should inherit the visibility of the associated repo.

For orgs, the ability to publish public container packages must be explicitly enabled using this setting.

image992×376 32.8 KB

Users should always be able to publish public container packages, but wasn’t working until a few days ago. You should find this is now fixed.

If you run your workflow from a user owned public repo, you should find the published image is automatically public. For org owned public repos, you will need to make sure the Public option is checked.