Read GitHub Packages permission for GitHub App?

[dgholz]

Hello, I’m looking at the list of permissions that an App can be granted and I can’t see one which would allow my app to fetch packages from a repo. Is there a permission I can grant my app to fetch packages from repos/orgs it’s installed into?

[francisfuzz]

👋 Hello, @dgholz ! Welcome to the GitHub Community Forum––we’re glad to see you post this question here. 👍

Permissions on “packages” is not currently available for all¹ GitHub Apps (see GitHub Apps Permissions for more details).

We’re always working to improve GitHub and the GitHub Support Community, and we consider every suggestion we receive. Would you mind submitting this through our official product feedback form so that our product team can track your request?

It may be worth noting that you can use either of these tokens to authenticate with GitHub Packages:

• a personal access token with the read:packages scope.
• the GITHUB_TOKEN that GitHub automatically creates for your repository when you enable GitHub Actions (see About GitHub Packages with GitHub Actions and Permissions for the GITHUB_TOKEN for more details).

We hope this helps!

---

¹ At this time of writing, the GITHUB_TOKEN from GitHub Actions is an installation token associated with a GitHub App owned by GitHub and is the only GitHub App with access to packages.

[6f6d6172]

Almost five years later and Github Packages can't be interacted with via a Github App despite it explicitly having a Packages permission. Naturally, the "Learn More" link takes you to a section of the documentation that doesn't exist. 🙄

You can't even take the service account route here because Fine Grained PATs also can't be used to interact with the Packages API.

For folks looking for a workaround, this is what I ended up doing for Rubygems:

• Set up an API key with releases:read permission (app/fine grained token should work)
• Find your release by tag
• Get the asset ID corresponding to your .gem file
• Download that asset
• Install that asset manually

This may work for other package types too.

@francisfuzz please consider updating the documentation or the app permissions page so people don't waste their time trying to interact with an API that doesn't exist. Right now interacting with packages via a token generated by an app returns a 403 which is absolutely the wrong HTTP code to be sending here.