Packages

About Permissions

github.token or GITHUB_TOKEN by default is scoped to the repository an Action runs in. Therefore, it cannot be used by default to consume packages created by other repositories, even in the same organization without either a configured PAT token with read:packages scope or where supported, allowing repositories to access a package.

There are up-to two ways to consume packages generated by other repositories depending on the package type:

• Option A: Personal Access Token with read:packages scope see Creating a PAT.
• Option B: Manage Actions access in the package registry.

TBC: Viability of Option B and how-to.

Maven Packages

Only option A is supported for Maven packages.

NPM Packages

Both option A or option B are supported for NPM packages.

Containers

Both option A and option B are supported for container images.