Skip to main content
We publish frequent updates to our documentation, and translation of this page may still be in progress. For the most current information, please visit the English documentation.
All products
GitHub Packages

This version of GitHub Enterprise was discontinued on 2023-03-15. No patch releases will be made, even for critical security issues. For better performance, improved security, and new features, upgrade to the latest version of GitHub Enterprise. For help with the upgrade, contact GitHub Enterprise support.

About permissions for GitHub Packages

In this article

Learn about how to manage permissions for your packages.

GitHub Packages is available with GitHub Free, GitHub Pro, GitHub Free for organizations, GitHub Team, GitHub Enterprise Cloud, GitHub Enterprise Server 3.0 or higher, and GitHub AE. For more information about upgrading your GitHub Enterprise Server instance, see "About upgrades to new releases" and refer to the Upgrade assistant to find the upgrade path from your current release version.

Permissions for packages

A package inherits the permissions and visibility of the repository in which the package is published. You can find a package scoped to a repository by going to the main page of the repository and clicking the Packages link to the right of the page.

About scopes and permissions for package registries

To use or manage a package hosted by a package registry, you must use a personal access token with the appropriate scope, and your personal account must have appropriate permissions.

For example:

  • To download and install packages from a repository, your personal access token must have the read:packages scope, and your user account must have read permission.
  • To delete a package on GitHub Enterprise Server, your personal access token must at least have the delete:packages and read:packages scope. The repo scope is also required for repo-scoped packages. For more information, see "Deleting and restoring a package."
ScopeDescriptionRequired permission
read:packagesDownload and install packages from GitHub Packagesread
write:packagesUpload and publish packages to GitHub Packageswrite
delete:packagesDelete packages from GitHub Packagesadmin
repoUpload and delete packages (along with write:packages, or delete:packages)write or admin

When you create a GitHub Actions workflow, you can use the GITHUB_TOKEN to publish and install packages in GitHub Packages without needing to store and manage a personal access token.

For more information, see:

About repository transfers

You can transfer a repository to another personal account or organization. For more information, see "Transferring a repository."

When you transfer a repository, GitHub transfers the packages associated with a repository as part of the repository transfer. All billable usage associated with the packages will subsequently be billed to the new owner of the repository. If the previous repository owner is removed as a collaborator on the repository, they may no longer be able to access the packages associated with the repository.

Maintaining access to packages in GitHub Actions workflows

To ensure your workflows will maintain access to your packages, ensure that you're using the right access token in your workflow and that you've enabled GitHub Actions access to your package.

For more conceptual background on GitHub Actions or examples of using packages in workflows, see "Managing GitHub packages using GitHub Actions workflows."

Access tokens

  • To publish and install packages associated with the workflow repository, use GITHUB_TOKEN.
  • To install packages associated with other private repositories that GITHUB_TOKEN can't access, use a personal access token

For more information about GITHUB_TOKEN used in GitHub Actions workflows, see "Automatic token authentication."