anchore / anchore/scan-action

Getting unauthorised for github container registry

Open
#232 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
287
Forks
95
Avg merge
13h 23m
Merged PRs (30d)
13

Description

I am using this action to scan images present in github container registry, I have set the registery-username variable to my username and have used ${{ secrets.GITHUB_TOKEN }} for my password. But when the action is running it is giving me unauthorised. To authenticate with GITHUB_TOKEN, I have followed this [github doc](https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token).

My github action:
```
scan:
name: 🛡️ Scan docker images
runs-on: ubuntu-latest
permissions:
packages: read
contents: read
needs: get_images
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.get_images.outputs.images) }}
steps:
- name: scan ghcr images
uses: anchore/scan-action@v3
if: ${{ startsWith( matrix.images, 'ghcr.io' ) }}
id: scan-ghcr
with:
image: ${{ matrix.images }}
fail-build: true
severity-cutoff: critical
output-format: json
registry-username: sabreen-parveen
registry-password: ${{ secrets.GITHUB_TOKEN }}
```

## Error
Getting following warning and error message:
image

image

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the workflow shown for anchore/scan-action@v3 with a GHCR image, the listed package and contents permissions, and GITHUB_TOKEN credentials. Compare the action's registry authentication behavior with the warning and error screenshots; done means the image scan authenticates successfully without the unauthorized error.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, github-actions
Domain
authentication, devops
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.