About permissions for GitHub Packages

Learn about how to manage permissions for your packages.

GitHub Packages 可用于 GitHub Free、GitHub Pro、组织的 GitHub Free、GitHub Team、GitHub Enterprise Cloud、GitHub Enterprise Server 和 GitHub AE。


GitHub Packages 不适用于使用旧版按仓库计划的帐户所拥有的私有仓库。 此外,使用旧版按仓库计划的帐户无法访问 Container registry,因为这些帐户是按仓库计费的。 更多信息请参阅“[GitHub 的产品](/articles/github-s-products)”。

The permissions for packages are either repository-scoped or user/organization-scoped.

Permissions for repository-scoped packages

A repository-scoped package inherits the permissions and visibility of the repository that owns the package. You can find a package scoped to a repository by going to the main page of the repository and clicking the Packages link to the right of the page.

The GitHub Packages registries below use repository-scoped permissions:

  • Docker registry (docker.pkg.github.com)
  • npm registry
  • RubyGems registry
  • Apache Maven registry
  • NuGet registry

Granular permissions for user/organization-scoped packages

Packages with granular permissions are scoped to a personal user or organization account. You can change the access control and visibility of the package separately from a repository that is connected (or linked) to a package.

Currently, only the Container registry offers granular permissions for your container image packages.

Visibility and access permissions for container images

如果您对容器映像具有管理员权限,可以将容器映像的访问权限设置为私有或公有。 公有映像允许匿名访问,无需身份验证或通过 CLI 登录即可进行拉取。

作为管理员,您还可以授予容器映像的访问权限,该权限与在组织和仓库级别设置的权限不同。

对于由用户帐户发布和拥有的容器映像,您可以向任何人授予访问角色。 对于组织发布和拥有的容器映像,您可以为组织中的任何人或团队授予访问角色。

权限访问描述
读取可以下载包。
可以读取包元数据。
写入可以上传和下载此包。
可以读取和写入包元数据。
管理员可以上传、下载、删除和管理此包。
可以读取和写入包元数据。
可以授予包权限。

For more information, see "Configuring a package's access control and visibility."

About scopes and permissions for package registries

To use or manage a package hosted by a package registry, you must use a token with the appropriate scope, and your user account must have appropriate permissions.

For example:

  • To download and install packages from a repository, your token must have the read:packages scope, and your user account must have read permission.
  • To delete a package on GitHub, your token must at least have the delete:packages and read:packages scope. The repo scope is also required for repo-scoped packages. For more information, see "Deleting and restoring a package."
ScopeDescriptionRequired permission
read:packagesDownload and install packages from GitHub Packagesread
write:packagesUpload and publish packages to GitHub Packageswrite
delete:packagesDelete packages from GitHub Packagesadmin
repoUpload and delete packages (along with write:packages, or delete:packages)write or admin

When you create a GitHub Actions workflow, you can use the GITHUB_TOKEN to publish and install packages in GitHub Packages without needing to store and manage a personal access token.

For more information, see:

Maintaining access to packages in GitHub Actions workflows

To ensure your workflows will maintain access to your packages, ensure that you're using the right access token in your workflow and that you've enabled GitHub Actions access to your package.

For more conceptual background on GitHub Actions or examples of using packages in workflows, see "Managing GitHub Packages using GitHub Actions workflows."

Access tokens

  • To publish packages associated with the workflow repository, use GITHUB_TOKEN.
  • To install packages associated with other private repositories that GITHUB_TOKEN can't access, use a personal access token

For more information about GITHUB_TOKEN used in GitHub Actions workflows, see "Authentication in a workflow."

GitHub Actions access for container images

To ensure your workflows have access to your container image, you must enable GitHub Actions access to the repositories where your workflow is run. You can find this setting on your package's settings page. For more information, see "Ensuring workflow access to your package."

此文档对您有帮助吗?隐私政策

帮助我们创建出色的文档!

所有 GitHub 文档都是开源的。看到错误或不清楚的内容了吗?提交拉取请求。

做出贡献

或, 了解如何参与。