bug?? "installation not allowed to Write organization package" ??

[garyy7811]

Select Topic Area

Bug

Body

I'm using a github app generated token to publish a npm package to github organization pacakge, encounter error:

npm notice
npm notice Publishing to https://npm.pkg.github.com/ with tag latest and default access
npm http fetch PUT 403 https://npm.pkg.github.com/@xxx%2fxxx-YYYs 420ms
npm verb stack HttpErrorGeneral: 403 Forbidden - PUT https://npm.pkg.github.com/@xxx%2fxxx-YYYs - Permission permission_denied: installation not allowed to Write organization package
npm verb stack at /opt/hostedtoolcache/node/18.18.2/x64/lib/node_modules/npm/node_modules/npm-registry-fetch/lib/check-response.js:95:15
npm verb stack at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
npm verb stack at async publish (/opt/hostedtoolcache/node/18.18.2/x64/lib/node_modules/npm/node_modules/libnpmpublish/lib/publish.js:54:17)
npm verb stack at async otplease (/opt/hostedtoolcache/node/18.18.2/x64/lib/node_modules/npm/lib/utils/otplease.js:4:12)
npm verb stack at async Publish.exec (/opt/hostedtoolcache/node/18.18.2/x64/lib/node_modules/npm/lib/commands/publish.js:123:7)
npm verb stack at async module.exports (/opt/hostedtoolcache/node/18.18.2/x64/lib/node_modules/npm/lib/cli-entry.js:61:5)
npm verb statusCode 403
npm verb pkgid @xxx/[email protected]
npm verb cwd /home/runner/work/odmd-app-YYYs/odmd-app-YYYs
npm verb Linux 6.2.0-1016-azure
npm verb node v18.18.2
npm verb npm v9.8.1
npm ERR! code E403
npm ERR! 403 403 Forbidden - PUT https://npm.pkg.github.com/@xxx%2fxxx-YYYs - Permission permission_denied: installation not allowed to Write organization package
npm ERR! 403 In most cases, you or one of your dependencies are requesting
npm ERR! 403 a package version that is forbidden by your security policy, or
npm ERR! 403 on a server you do not have access to.
npm verb exit 1
npm verb code 1

private key generates jwt and generate installation token:
token is from post(${GITHUB_API_BASE_URL}/app/installations/${get_odmd_ghApp_installationID()}/access_tokens ...
all permissions added to github app.

this is more likely a bug ...

[garyy7811]

related to https://github.com/orgs/community/discussions/24636 ??

[DoisKoh]

I'm having the same issue... I've spent a whole day on this and can't figure out what's wrong. I'm also starting to think it's a bug.

I've tried granting more permissions than necessary to the GitHub App... I've tried generating the access token myself instead of using the actions/create-github-app-token@v1 action, I've made sure the GitHub App has access to all repositories, I've made sure the repository has write (also tried admin) access for Actions to the package. I've also tried switching the package between private and internal, and even public... It's starting to seem like installations are simply never allowed to write to organization packages (?)

Has anyone managed to get this working?

[ganiszulfa]

hi @garyy7811 @DoisKoh, go to "Workflow permissions" in https://github.com/YOUR_USERNAME/YOUR_REPO/settings/actions and select "Read and write permissions".

this worked for me. Hope this work for you too.

[DoisKoh]

That's a different thing. I can confirm that it was a bug - GitHub Apps can't write to packages.

The configuration you're referring to affects $GITHUB_TOKEN.

[ganiszulfa]

I googled the error message and was brought here, I thought it was the same or similar. Well, just in case any one else having this error message in their github workflows, that's the solution.