Skaffold构建推送镜像成功后GHCR未授权访问问题求助

问题 #

在GitHub Workflow中执行skaffold build时，Gradle Jib能成功构建并推送镜像到GHCR，但之后Skaffold尝试拉取刚构建的镜像时提示未授权失败。本地执行该命令无问题，直接在Workflow里调用gradlew jib也不会失败。

相关日志 #

Built and pushed image as ghcr.io/tobias-neubert/motd-service:453f4c4-dirty

BUILD SUCCESSFUL in 11s
4 actionable tasks: 4 executed
time="2023-02-15T12:07:09Z" level=error msg="No matching credentials were found for \"ghcr.io\""
time="2023-02-15T12:07:09Z" level=error msg="No matching credentials were found for \"ghcr.io\""
getting image: GET https://ghcr.io/token?scope=repository%3Atobias-neubert%2Fmotd-service%3Apull&service=ghcr.io: UNAUTHORIZED: authentication required
Error: Process completed with exit code 1.

GitHub Workflow配置 #

name: Build and push motd-service

on:
  push:

permissions:
  packages: write

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - name: Checkout Code
        uses: actions/checkout@v3

      - name: Set up Java
        uses: actions/setup-java@v2
        with:
          java-version: 17
          distribution: temurin

      - name: Setup Gradle
        uses: gradle/gradle-build-action@v2

      - name: Make gradlew executable
        run: chmod +x ./gradlew

      - name: Install skaffold
        run: |
          curl -Lo skaffold https://storage.googleapis.com/skaffold/releases/latest/skaffold-linux-amd64 && \
          sudo install skaffold /usr/local/bin/

      - name: Deactivate collecting skaffold metrics
        run: skaffold config set --global collect-metrics false

      - name: Build the motd image
        env:
          GH_PASSWORD: '${{ secrets.GITHUB_TOKEN }}'
        run: skaffold build

原因与解决办法 #

核心原因 #

Skaffold在构建完成后会默认拉取镜像做验证，而当前Workflow仅配置了packages: write权限，且Skaffold没有拿到GHCR的有效认证凭据，导致拉取时触发未授权错误。直接用gradlew jib不会出问题，是因为Jib做完推送就结束，不会额外执行拉取验证步骤。

解决步骤 #

1. 补充权限配置
   在Workflow的permissions块中显式添加拉取所需权限，修改后如下：

   permissions:
     packages: write
     contents: read
   

   虽然packages: write理论上包含同包的拉取权限，但显式声明能避免权限校验的潜在问题。

2. 为Skaffold配置GHCR登录凭据
   在执行skaffold build前，先通过Docker登录动作获取GHCR的认证信息，让Skaffold能复用这个凭据。在Workflow中添加以下步骤，放在Install skaffold之后、Build the motd image之前：

   - name: Login to GHCR
     uses: docker/login-action@v2
     with:
       registry: ghcr.io
       username: ${{ github.actor }}
       password: ${{ secrets.GITHUB_TOKEN }}
   

3. 禁用Skaffold的镜像拉取验证（可选）
   如果不需要这个验证步骤，可以直接修改Skaffold命令或者配置文件：

   • 命令行添加参数：skaffold build --pull-policy never
   • 或者在skaffold.yaml中配置：

     build:
       local:
         pull: false
     

内容的提问来源于stack exchange，提问作者Tobias Neubert