Getting unauthorised for github container registry
- Dominant language
- JavaScript
- Stars
- 287
- Forks
- 95
- Avg merge
- 13h 23m
- Merged PRs (30d)
- 13
Description
I am using this action to scan images present in github container registry, I have set the registery-username variable to my username and have used ${{ secrets.GITHUB_TOKEN }} for my password. But when the action is running it is giving me unauthorised. To authenticate with GITHUB_TOKEN, I have followed this [github doc](https://docs.github.com/en/packages/managing-github-packages-using-github-actions-workflows/publishing-and-installing-a-package-with-github-actions#upgrading-a-workflow-that-accesses-a-registry-using-a-personal-access-token).
My github action:
```
scan:
name: 🛡️ Scan docker images
runs-on: ubuntu-latest
permissions:
packages: read
contents: read
needs: get_images
strategy:
fail-fast: false
matrix: ${{ fromJSON(needs.get_images.outputs.images) }}
steps:
- name: scan ghcr images
uses: anchore/scan-action@v3
if: ${{ startsWith( matrix.images, 'ghcr.io' ) }}
id: scan-ghcr
with:
image: ${{ matrix.images }}
fail-build: true
severity-cutoff: critical
output-format: json
registry-username: sabreen-parveen
registry-password: ${{ secrets.GITHUB_TOKEN }}
```
## Error
Getting following warning and error message:
Contributor guide
Research direction
Start by reproducing the workflow shown for anchore/scan-action@v3 with a GHCR image, the listed package and contents permissions, and GITHUB_TOKEN credentials. Compare the action's registry authentication behavior with the warning and error screenshots; done means the image scan authenticates successfully without the unauthorized error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, github-actions
- Domain
- authentication, devops
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100