Docker@v2无法推送镜像至GHCR（访问被拒绝）

在Azure DevOps流水线中使用Docker@v2任务推送镜像至ghcr.io时，始终提示访问被拒绝。相关排查信息如下：

• 同一GHCR服务连接可正常完成登录操作
• 该流水线对接Docker Hub服务连接时运行完全正常
• 服务连接所用的GitHub个人访问令牌（PAT）在本地命令行中可正常推送镜像，且已确认PAT具备write:packages权限
• 已尝试推送至三种场景：无仓库关联的包、与仓库关联的包、本人为管理员的多个组织，均失败

推送日志 #

2024-11-06T07:18:53.5923641Z The push refers to repository [ghcr.io/my-github-org/my-repo]
2024-11-06T07:18:53.6754212Z ead24dff829c: Preparing
2024-11-06T07:18:53.6754669Z 5f70bf18a086: Preparing
2024-11-06T07:18:53.6754950Z bff24fa5ba6d: Preparing
2024-11-06T07:18:53.6755208Z 734661639d51: Preparing
2024-11-06T07:18:53.6755464Z 008aac071916: Preparing
2024-11-06T07:18:53.6755784Z 261abc8281b7: Preparing
2024-11-06T07:18:53.6756033Z 7794e8d8212d: Preparing
2024-11-06T07:18:53.6756282Z ceffe60ed721: Preparing
2024-11-06T07:18:53.6756529Z 261abc8281b7: Waiting
2024-11-06T07:18:53.6756777Z 7794e8d8212d: Waiting
2024-11-06T07:18:53.6757020Z ceffe60ed721: Waiting
2024-11-06T07:18:53.8064164Z denied: denied
2024-11-06T07:18:53.8071559Z
2024-11-06T07:18:53.8100848Z ##[error]denied: denied
2024-11-06T07:18:53.8205302Z ##[error]The process '/usr/bin/docker' failed with exit code 1
2024-11-06T07:18:53.8277688Z ##[section]Finishing: Push an image

流水线YAML配置 #

# Docker
# Build a Docker image
# https://docs.microsoft.com/azure/devops/pipelines/languages/docker

pr:
  branches:
    include:
      - feat/k8s-test-env

trigger:
  branches:
    include:
      - feat/k8s-test-env

resources:
  - repo: self

variables:
  tag: "$(Build.BuildId)"

stages:
  - stage: BuildandPush
    displayName: Build image and push to ghcr.io
    jobs:
      - job: Build
        displayName: Build
        pool:
          vmImage: ubuntu-latest
        steps:
          - task: Docker@2
            displayName: Build an image
            inputs:
              command: build
              dockerfile: "**/Dockerfile"
              containerRegistry: ghcr-io
              repository: my-github-organization/my-repo
              tags: |
                test1$(tag)
          - task: Docker@2
            displayName: Push an image
            inputs:
              command: push
              containerRegistry: ghcr-io
              repository: my-github-organization/my-repo
              tags: |
                test1-$(tag)

GHCR服务连接配置 #

• 连接类型：Docker Registry
• 注册表地址：ghcr.io
• 认证方式：用户名 + 个人访问令牌（PAT）

内容的提问来源于stack exchange，提问作者Anders Bornholm