GitHub Container Registry and GitHub App

[Hazmi35]

I'm looking for a best way to access ghcr.io private packages from automation outside GitHub Actions, i.e production servers.

The only thing I know working for authentication in ghcr.io is PAT, but creating a GitHub user for stuffs like this should be avoidable (although GitHub allow machine-users, but still)

I've tried creating GitHub App Installation Token, docker login does works, but docker pull doesn't

I saw no documentation about this either, is there any way to authenticate with ghcr.io other than PAT?

[dgholz]

is there any way to authenticate with ghcr.io other than PAT?

You can authenticate with the GITHUB_TOKEN generated for a workflow run, if the image is available to the workflow's repository. That's it, it's either that token in a workflow for images on the repo, or a PAT (https://docs.github.com/en/packages/learn-github-packages/introduction-to-github-packages#authenticating-to-github-packages)

[Hazmi35]

Yes, that can be used for GitHub Actions, but not on our servers. And also: The GITHUB_TOKEN expires when a job finishes or after a maximum of 24 hours.

[dgholz]

Yes,

it's either that token in a workflow for images on the repo, or a PAT

Not a lot of options!

[acuD1]

I link this issue here: https://github.com/orgs/community/discussions/24636