GITHUB_TOKEN does not have access to other private packages

[Ignigena]

Based on the documentation, I have my workflow set up to install from my GitHub Package Registry:

    steps:
    - uses: actions/checkout@v1
    - uses: actions/setup-node@v1
      with:
        node-version: 10.x
        registry-url: 'https://npm.pkg.github.com'
    - run: npm ci
      env:
        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

However, I get a 404 when trying to install any private packages scoped to my account with this configuration. Just to clarify these are private packages within the same account that this repo and workflow exists.

Using the exact same configuration, if I replace with a personal access token I've created, I am able to install private packages without issue.

[damccorm]

@Phanatic any idea why this would work with a PAT but not the GITHUB_TOKEN?

[Phanatic]

hmm, @Ignigena are the private packages hosted in the same repository as the workflow or are they in another repository under the same account?

[Ignigena]

The private packages are in another repository under the same account. Both have been published to GPR but as private packages.

[Phanatic]

Ahh, that's what I figured. The GITHUB_TOKEN we generate is scoped to the repository that is running the Workflow. Unfortunately, this doesn't allow us to install or publish packages from/to other repositories. I'll bring this up in planning and we can figure out how to proceed here.

[Ignigena]

I figured that might be the case. Would love a solution at least for installing within the same organization. Would rather not have to create a personal access token for each repository -- we're using private NPM modules quite a bit to share business logic/components between all our repos.

We're already forced to do this with NPM's package registry and our TravisCI builds, but was hoping to avoid with Actions and GPR if we can. Totally understand there are probably other implications here, but keep us updated -- would love for this to be as seamless as publishing to GPR is now via an Action 🙂

[krystof-k]

This is a huge issue, almost impossible to use Actions CI for us now (without that SSH key fiddling we use now for CircleCI). @Phanatic please keep us posted – token working across the whole organization is a must.

[schie]

@Phanatic, any update on this?

[SanderKnape]

This is indeed a big issue and makes working with the Package Registry much harder. It is very inconvenient having to distribute a personal access token that must be set as a secret on each repository. Please give the GITHUB_TOKEN read permissions to all registries in the same organization.

[PeterHewat]

As of today, it now works. See #53

[negebauer]

No, it isn't fixed. #53 is about publishing a package, which can be done.
This is about pulling packages from other private repos, which can't be done, it requires a personal access token.

This is also a big issue for me and my company. There should be a way to have an org token that gives read access to the org's packages. Or give GITHUB_TOKEN to other packages of the same org

[bryanmacfarlane]

This is about pulling packages from other private repos, which can't be done, it requires a personal access token.

A PAT is the solution for other private repos.

This also isn't an issue with setting up node (this repo).

If you have a request for the service to expand the scope of the token, please leave feedback on community

https://github.community/

Thanks!

[krystof-k]

Posted.

[Alappin]

I posted a follow up issue to reproduce a similar "Error: 404 Not Found" bug on https://github.community/t5/GitHub-Actions/Package-not-found-in-the-Github-Registry/m-p/31685/highlight/false#M864

What repository do we post GPR related issues like the one i just mentioned above?