gradle jib cannot authenticate against ghcr in GitHub workflow - gradle

Question

This is somehow strange: I can build and push m ycontainer image with gradle jib to my github container registry (ghcr) locally but not in a github worflow. Even more strange is, that as soon as the git workflow fails, the local jib fails with the same error. To make it work at least locally again, I have to create a new github token.
Steps to reproduce:
My build.gradle
plugins {
id 'java'
id 'idea'
id 'org.springframework.boot' version '3.0.1'
id 'com.google.cloud.tools.jib' version '3.3.1'
id 'io.spring.dependency-management' version '1.1.0'
}
java {
sourceCompatibility = JavaVersion.VERSION_17
targetCompatibility = JavaVersion.VERSION_17
}
compileJava.options.encoding = "UTF-8"
compileTestJava.options.encoding = "UTF-8"
configurations {
published
compileOnly {
extendsFrom annotationProcessor
}
}
dependencies {
implementation 'org.springframework.boot:spring-boot-starter-web'
annotationProcessor 'org.springframework.boot:spring-boot-configuration- processor'
testImplementation 'org.springframework.boot:spring-boot-starter-test'
testImplementation('org.assertj:assertj-core')
testImplementation('org.junit.jupiter:junit-jupiter-api')
testRuntimeOnly('org.junit.jupiter:junit-jupiter-engine')
}
tasks.withType(Test) {
useJUnitPlatform()
}
task prepareKotlinBuildScriptModel {
}
springBoot {
buildInfo()
}
bootJar {
enabled = false
}
jar {
enabled = true
}
def baseImage = 'ghcr.io/tobias-neubert/eclipse-temurin:17.0.2_8-jre'
jib {
from {
image = baseImage
auth {
username = "tobias-neubert"
password = "${System.getenv("GITHUB_PASSWORD")}"
}
}
to {
image = 'ghcr.io/tobias-neubert/motd-service'
auth {
username = "tobias-neubert"
password = "${System.getenv("GITHUB_PASSWORD")}"
}
}
container {
mainClass = 'com.neubert.scaffold.motdservice.MotdServiceApplication'
ports = ['8080']
}
}
Create a new personal access token in github.
Execute locally GITHUB_PASSWORD=<personal-access-token> ./gradlew :motd-service:jib
The image is built and pushed successfully to the ghcr, where I can see it. You execute a local build repeatedly, it will succeed.
My github workflow:
name: Build and push motd-service
on:
push:
branches:
- actions
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout#v3
- name: Set up Java
uses: actions/setup-java#v2
with:
java-version: 17
distribution: temurin
- name: Setup Gradle
uses: gradle/gradle-build-action#v2
- name: Make gradlew executable
run: chmod +x ./gradlew
- name: Build the motd image
run: |
GITHUB_PASSWORD=<personal-access-token> ./gradlew :motd-service:jib
The job fails with:
Execution failed for task ':motd-service:jib'.
> com.google.cloud.tools.jib.plugins.common.BuildStepsExecutionException: Build image failed, perhaps you should make sure you have permissions for ghcr.io/tobias-neubert/eclipse-temurin and set correct credentials. See https://github.com/GoogleContainerTools/jib/blob/master/docs/faq.md#what-should-i-do-when-the-registry-responds-with-forbidden-or-denied for help
Execute GITHUB_PASSWORD=<personal-access-token> ./gradlew :motd-service:jib locally again, and it fails with the same error.
I must miss something important here. Can you tell me what?

Answer 1

I found it: I am using the GITHUB_TOKEN now for accessing the GHCR. I tried that before but I did not realize that
you have to set the write permission in your workflow for that token and
you give the repository of your workflow permission to write into the desired package and to read the desired base package.
So with this workflow and the write permission in the package settings for my repository it works:
name: Build and push motd-service
on:
push:
branches:
- actions
permissions:
packages: write
jobs:
build:
runs-on: ubuntu-latest
steps:
- name: Checkout Code
uses: actions/checkout#v3
- name: Set up Java
uses: actions/setup-java#v2
with:
java-version: 17
distribution: temurin
- name: Setup Gradle
uses: gradle/gradle-build-action#v2
- name: Make gradlew executable
run: chmod +x ./gradlew
- name: Build the motd image
env:
GH_PASSWORD: '${{ secrets.GITHUB_TOKEN }}'
run: "./gradlew jib"