Authorization on Github Packages

[FelixHennerich]

Select Topic Area

Question

Body

Hi,
I've run into this error and I don't understand why
Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.

I've got an GITHUB_TOKEN with all admin permission that I can give to it and as GITHUB_USER I took felixhennerich

I See no reason for this error but still get it. Any ideas?

[Crazydevil0]

• Token Scope: Even though you've set the GITHUB_TOKEN to have all admin permissions, GitHub Packages might require specific scopes. Make sure your token has the read:packages, write:packages, delete:packages, and repo scopes.
• Token Expiry: Tokens do expire. Double-check that your token is still valid.
• User Association: Since you're using the username felixhennerich, make sure that the token is associated with this user, and that this user has appropriate permissions to interact with the repo/package.
• Repository Permission: This might sound simple, but ensure felixhennerich has the right permissions to the repo. Sometimes repo settings can override token permissions.
• Environment Variables: Make sure that the GITHUB_TOKEN and GITHUB_USER environment variables are correctly set in your GitHub Actions or wherever you're using them. A simple typo can throw things off.
• CLI vs Actions: Are you encountering this issue in a GitHub Action, or when you're running something manually from the CLI? Sometimes the environment in which the token is used can cause issues.
• Check Logs and Debug: This is the time to dive deep into logs. Any additional output you can get will help. GitHub Actions should provide detailed logs for each run. Make sure you check those thoroughly.
• Firewall/VPN: This one's a bit out there, but I've seen firewalls and VPNs mess with tokens. Any chance something network-related is affecting the token?

[jsmith-itscovered]

I'm fairly convinced GITHUB_TOKEN is github broken, for some purposes.

I've had a heckuva time recently, whereupon the runner can use GITHUB_TOKEN configured with packages: write to log into ghcr.io just fine, to pull my custom runner container, and I can use a GITHUB_TOKEN of the same configuration to publish maven packages, which is actually the way it needs to be done, to make those images downloadable, via personal access tokens.

But if I try to install the maven packages into a springboot service, from another workflow, a GITHUB_TOKEN of the same configuration cannot pull those dependencies. The fact that the token is the problem isn't obvious, because it reports that it simply can't find the dependencies. It doesn't 401.

Strangely enough, I only figured this out, because my personal token I generated, which is tied to my github user id, can pull these dependencies, from my local environment. But if I published from my personal token, even my personal token would not be able to read those packages.

To say nothing of not wanting to make a personal token companywide, the work-around is to generate a personal token from a "machine user" account, which we wish we didn't have to waste a license on, because two instances of GITHUB_TOKEN should work to read the packages they wrote, if they are configured correctly.

[brad-technologik]

I'm also convinced it's broken. dotnet nuget push didn't work if I added the source via dotnet nuget add source and GITHUB_TOKEN. It would randomly fail with 'broken pipe'. Luckily dotnet nuget push works with the API key parameter, but I'm having a hell of a time trying to get another action to pull nuget packages with GITHUB_TOKEN.

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[oskar-koli]

I had trouble authenticating a Github Action to pull Nuget dependencies from Github Packages using
dotnet nuget add source --username ${{ github.actor }} --password ${{ secrets.GITHUB_TOKEN }} --store-password-in-clear-text --name github "https://nuget.pkg.github.com/COMPANY_NAME/index.json"
Even though the command above ran without errors, the build itself was failing with a "Your request could not be authenticated by the GitHub Packages service" message. But I finally got it working by adding the repository the Action is in to the list of "Manage Actions access" in the package which it was trying to pull.

[ankushbahale24]

How to upload maven packages on GitHub using GitHub token instead of PAT Token?

[BinToss]

To push packages to a GitHub package repository with GITHUB_TOKEN, specify the packages: write permission in the job or workflow e.g.

jobs:
  ci:
    name: CI
    uses: ./.github/workflows/ci.yml
  # based on https://github.com/semantic-release/semantic-release/blob/master/docs/recipes/ci-configurations/github-actions.md
  release:
    needs: [ci]
    runs-on: ubuntu-latest
    permissions:
      contents: write # to be able to publish a GitHub release
      issues: write # to be able to comment on released issues
      pull-requests: write # to be able to comment on released pull requests
      id-token: write # to enable use of OIDC for npm provenance
      packages: write # for pushing GitHub Nuget packages

    steps:

[anderson895]

export GITHUB_TOKEN=your_personal_access_token
export GITHUB_USER=your_github_username

echo "//npm.pkg.github.com/:_authToken=${GITHUB_TOKEN}" > ~/.npmrc

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬