因授权问题无法将Docker镜像推送至GitHub Registry

我有一个简单的Node应用，Dockerfile内容如下：

FROM node:20-alpine

WORKDIR /app

COPY package*.json ./

RUN yarn

COPY . .

EXPOSE 8080

CMD [ "yarn", "start" ]

本地构建运行都正常，但通过GitHub Actions推送镜像到GitHub Registry时失败，已配置仓库的repository secrets，工作流配置如下：

name: Deploy to Production

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4.0.0

      - name: Set up Docker
        uses: docker/setup-buildx-action@v2.10.0

      - name: Login to Docker Hub
        uses: docker/login-action@v2
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4.2.1
        with:
          context: .
          push: true
          tags: docker.pkg.github.com/${{ github.repository }}/app:${{ github.sha }}
          build-args: |
            NODE_VERSION=20

报错信息：

ERROR: failed to solve: failed to push docker.pkg.github.com//reponame/app:6e999cfdacd6dc6b0a0b1e910a5df587ff0e29d0: unexpected status from HEAD request to https://docker.pkg.github.com/v2//reponame/app/blobs/sha256:b57f8774f8f3f8e4585beb859bb784b1cb1e558b851438ee332890b5f39f5aee: 401 Unauthorized Error: buildx failed with: ERROR: failed to solve: failed to push docker.pkg.github.com//reponame/app:6e999cfdacd6dc6b0a0b1e910a5df587ff0e29d0: unexpected status from HEAD request to https://docker.pkg.github.com/v2/**/reponame/app/blobs/sha256:b57f8774f8f3f8e4585beb859bb784b1cb1e558b851438ee332890b5f39f5aee: 401 Unauthorized

请问这是什么原因？缺少哪种授权？

核心问题 #

你当前登录的是Docker Hub，但要推送的目标仓库是GitHub Registry（docker.pkg.github.com），二者属于不同的镜像服务，授权凭证不匹配，因此触发401未授权错误。

修复步骤 #

1. 替换登录目标仓库
   把原工作流中的Docker Hub登录步骤，替换为GitHub Registry的登录步骤：

   - name: Login to GitHub Registry
     uses: docker/login-action@v2
     with:
       registry: docker.pkg.github.com
       username: ${{ github.actor }}
       password: ${{ secrets.GITHUB_TOKEN }}
   

   注：GITHUB_TOKEN是GitHub Actions自动生成的内置令牌，只要仓库开启Packages功能，它默认拥有推送镜像到当前仓库Registry的权限。如果需要更细粒度的权限，也可以手动创建带write:packages权限的个人访问令牌（PAT），存入仓库secrets后替换GITHUB_TOKEN。

2. 推荐使用新版GitHub容器地址
   docker.pkg.github.com是旧版GitHub Packages地址，新版已统一使用ghcr.io，建议同步修改标签和登录配置：

   • 登录步骤改为：

     - name: Login to GitHub Container Registry
       uses: docker/login-action@v2
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ secrets.GITHUB_TOKEN }}
     

   • 镜像标签改为：

     tags: ghcr.io/${{ github.repository }}/app:${{ github.sha }}
     

3. 确认仓库权限
   确保你的GitHub仓库已启用Packages功能，且使用的令牌拥有write:packages权限。

修正后的完整工作流示例 #

name: Deploy to Production

on:
  push:
    branches:
      - main

jobs:
  deploy:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout code
        uses: actions/checkout@v4.0.0

      - name: Set up Docker
        uses: docker/setup-buildx-action@v2.10.0

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v2
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Build and push Docker image
        uses: docker/build-push-action@v4.2.1
        with:
          context: .
          push: true
          tags: ghcr.io/${{ github.repository }}/app:${{ github.sha }}
          build-args: |
            NODE_VERSION=20

内容的提问来源于stack exchange，提问作者kar