Personal Access Tokens

  1. Why "Manage Actions Access (Write)" is Needed

When an automated workflow runs in GitHub Actions, it authenticates against GHCR using the built-in, temporary ${{ secrets.GITHUB_TOKEN }}. However, permissions must be aligned on both the workflow side and the registry package side:

  • The Manual Push Ownership Problem: If a container image was initially built and pushed manually from a developer's local terminal using a Personal Access Token (PAT), GitHub assigns ownership of that package strictly to the personal user profile rather than linking it directly to the repository.
  • The 403 Forbidden Failure: Even if the workflow YAML file specifies permissions: packages: write, GitHub's default security model prevents the repository's automated token from overwriting a user-owned package. When the pipeline attempts docker push, GHCR rejects it with a 403 Forbidden error.
  1. What Changing the Access Role to "Write" Achieves

Inside GHCR Package Settings, the Manage Actions access section controls which repositories have permission to interact with the container package:

  • Default Role (Read): When a repository is first connected under Manage Actions access, GitHub defaults its role to Read, which only grants permission to pull/download images.
  • Elevated Role (Write / Admin): Explicitly changing the role dropdown from Read to Write (or Admin) grants the repository's automated pipeline the explicit authorization needed to publish new image tags and overwrite existing layers (such as :latest).
  1. Step-by-Step Configuration Workflow

To grant write access to the pipeline:

  1. Navigate to your GitHub Profile → Packages tab.
  2. Click on the container package (e.g., astro_portfolio).
  3. On the right-hand sidebar, click Package settings.
  4. Scroll to the Manage Actions access section and click Add Repository.
  5. Search for and select the code repository.
  6. Change the Role dropdown from Read to Write or Admin.

  1. Broader Context: Automated vs. Manual Package Linking

  2. Native GitHub Actions Linking: When a package is created and pushed natively from a GitHub Actions workflow from day one, GitHub automatically links the package to the repository dashboard.

  3. Manual Push Workarounds: If manual pushes precede CI/CD automation, developers must either configure Manage Actions access (Write) in the UI, link the repository via "Connect repository", or include the metadata label inside the Dockerfile: