The permissions for packages are either repository-scoped or user/organization-scoped.
A repository-scoped package inherits the permissions and visibility of the repository that owns the package. You can find a package scoped to a repository by going to the main page of the repository and clicking the Packages link to the right of the page. For more information, see "Connecting a repository to a package."
The GitHub Packages registries below only use repository-scoped permissions:
- Docker registry (
- RubyGems registry
- Apache Maven registry
- NuGet registry
For Container registry and npm registry, you can choose to allow packages to be scoped to a user, an organization, or linked to a repository.
Packages with granular permissions are scoped to a personal user or organization account. You can change the access control and visibility of the package separately from a repository that is connected (or linked) to a package.
Currently, the Container registry and npm registry offer granular permissions for your container image packages.
如果您对容器映像具有管理员权限，可以将容器映像的访问权限设置为私有或公有。 公有映像允许匿名访问，无需身份验证或通过 CLI 登录即可进行拉取。
For more information, see "Configuring a package's access control and visibility."
To use or manage a package hosted by a package registry, you must use a token with the appropriate scope, and your personal account must have appropriate permissions.
- To download and install packages from a repository, your token must have the
read:packagesscope, and your user account must have read permission.
- To delete a package on GitHub Enterprise Cloud, your token must at least have the
reposcope is also required for repo-scoped packages. For more information, see "Deleting and restoring a package."
|Download and install packages from GitHub Packages||read|
|Upload and publish packages to GitHub Packages||write|
|Delete packages from GitHub Packages||admin|
|Upload and delete packages (along with ||write or admin|
When you create a GitHub Actions workflow, you can use the
GITHUB_TOKEN to publish and install packages in GitHub Packages without needing to store and manage a personal access token.
For more information, see:
- "Configuring a package’s access control and visibility"
- "Publishing and installing a package with GitHub Actions"
- "Creating a personal access token"
- "Available scopes"
To ensure your workflows will maintain access to your packages, ensure that you're using the right access token in your workflow and that you've enabled GitHub Actions access to your package.
For more conceptual background on GitHub Actions or examples of using packages in workflows, see "Managing GitHub Packages using GitHub Actions workflows."
- To publish packages associated with the workflow repository, use
- To install packages associated with other private repositories that
GITHUB_TOKENcan't access, use a personal access token
For more information about
GITHUB_TOKEN used in GitHub Actions workflows, see "Authentication in a workflow."
To ensure your workflows have access to your container image, you must enable GitHub Actions access to the repositories where your workflow is run. You can find this setting on your package's settings page. For more information, see "Ensuring workflow access to your package."