When will GitHub Packages add support for GitHub Apps?

[dgholz]

I want to generate an OAuth token (like from gh auth) via our setup tools when onboarding new devs, so they don't need to generate a PAT (and remember to expire it, rotate it, etc.) to install our private packages from GitHub Packages.

I know that GitHub Packages only supports PATs through its API and the language-specific registries. I see that it's not very obvious, a lot of people have asked about this (#33202, #28039, #34084).

When will GitHub Packages support tokens other than PATs? That is, GitHub App tokens and OAuth App tokens.

[chriscarpenter12]

This seems pretty shortsighted not being able to interact with Packages from an App. What's more confusing is that on the permission page for Apps there's a setting for accessing Packages which implied to me it had access

But I too get permission denied when trying to push a package using an App ghs token

npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://npm.pkg.github.com/@org%2fpackage-name - Permission permission_denied: installation not allowed to Create organization package
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.

[simonoff]

Yes, but GitHub focusing more in Copilot than on this "stupid" feature

[Drowze]

Also if you go to your package settings page at https://github.com/orgs/ORG/packages/rubygems/PACKAGE/settings, you'll find an access setting as such:

...but adding repositories to that setting really did nothing. I didn't find any way that I can download packages (tried with Ruby packages) using the GITHUB_TOKEN on my GH Actions workflow (which I suppose is similar if not the same as a GitHub App-generated user token).

This is really unfortunate... I don't see any solution besides service accounts with Personal Access Tokens 😢

[mr-pinzhang]

It seems like a very practical feature. Hopefully, GH team can have it done very soon.

[fsdh-breakglass-01]

Would love to have this option.

[cmhac]

This limitation is also causing me headaches today in November 2024

[mat007]

Yeah, pretty annoying to keep bot users around just for that reason…