GitHub Workflow推送镜像至Azure容器注册表遇权限拒绝问题求助

问题现象 #

使用GitHub Workflow构建ASP.NET 6项目，通过Dockerfile生成镜像并推送到私有Azure容器注册表时，触发以下错误：

buildx failed with: error: denied: requested access to the resource is denied

已在仓库Secrets > Action中配置ACR_HOST、ACR_USERNAME、ACR_PASSWORD密钥，本地使用相同凭证可正常推送，但Workflow中推送失败，且Azure门户无该Workflow的登录记录，怀疑docker/build-push-action@v3.1.1未使用之前的登录状态。

初始Workflow配置如下：

name: Docker Image CI

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Login To Azure Container Registr 
      uses: Azure/docker-login@v1 
      with:
        login-server: ${{ secrets.ACR_HOST }}
        username: ${{ secrets.ACR_USERNAME }}
        password: ${{ secrets.ACR_PASSWWORD }} 
    - name: Build And Push Docker Images
      uses: docker/build-push-action@v3.1.1
      with:
        push: true
        file: ./Dockerfile
        tags: companyname/projectname:${{ github.run_number }}

解决方案 #

1. 修正Secrets引用拼写错误 #

初始配置中密码字段拼写错误：ACR_PASSWWORD多了一个W，应改为ACR_PASSWORD，这会直接导致登录失败，后续推送无权限。

2. 确保镜像Tag包含ACR登录地址 #

镜像Tag必须以你的Azure容器注册表登录服务器地址开头，否则Docker会默认尝试推送到Docker Hub，而非私有ACR。修正后的Tag格式应为：

tags: ${{ secrets.ACR_HOST }}/companyname/projectname:${{ github.run_number }}

3. 改用官方Docker登录Action提升兼容性 #

Azure/docker-login@v1与docker/build-push-action的兼容性可能存在问题，建议替换为官方的docker/login-action：

- name: Login to Azure Container Registry
  uses: docker/login-action@v2
  with:
    registry: ${{ secrets.ACR_HOST }}
    username: ${{ secrets.ACR_USERNAME }}
    password: ${{ secrets.ACR_PASSWORD }}

4. 完整修正后的Workflow配置 #

name: Docker Image CI

on:
  push:
    branches: [ "main" ]
  pull_request:
    branches: [ "main" ]

jobs:
  build:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v3
    - name: Login to Azure Container Registry
      uses: docker/login-action@v2
      with:
        registry: ${{ secrets.ACR_HOST }}
        username: ${{ secrets.ACR_USERNAME }}
        password: ${{ secrets.ACR_PASSWORD }}
    - name: Verify Docker Login Status
      run: docker info | grep -i "${{ secrets.ACR_HOST }}"
    - name: Build And Push Docker Images
      uses: docker/build-push-action@v3.1.1
      with:
        push: true
        file: ./Dockerfile
        tags: ${{ secrets.ACR_HOST }}/companyname/projectname:${{ github.run_number }}

5. 额外验证步骤 #

添加Verify Docker Login Status步骤可以确认Docker是否已成功登录到目标ACR，便于排查登录环节的问题。

内容的提问来源于stack exchange，提问作者Jay