GitHub packages connected to public repository uploaded from Actions incorrectly as private [BUG, AFFECTS BILLING]

[as-ascii]

Select Topic Area

Question

Body

Dear All,

When GitHub packages are uploaded in GitHub actions using GITHUB_TOKEN (vcpkg binary cache with nuget provider) in public repository their visiblity is:

• public when repository owner is a person (correct) *UPDATED: incorrect as well.
• private when repository owner is organization (incorrect)

Is this a bug or some hidden settings that I cannot find? *UPDATED: settings reviewed by several users

Package settings in the organization is set to "inherit access settings from the repository".

[hellodword]

Same issue

[cig0]

It's nice to know I'm not the only one.

Something must have changed, as the packages were being correctly published as public not so long ago.

[as-ascii]

It seems that there is no difference between user owner and organization owner. My initial observation can be related just with time of publishing. So you are probably right - something must have changed. Maybe there is some github changelog available to check what was modified?

[as-ascii]

Do you know maybe if this is a proper way of reporting the issue to GitHub developers or support team?
Adding repository url here just in case:
https://github.com/docwire/docwire

[cig0]

In short, no. It is my first time trying to raise an issue with the GH team; I'm just following your tracks 😄

That said, as per this document, it seems we are in the right place: https://docs.github.com/en/support/contacting-github-support/creating-a-support-ticket

[as-ascii]

I've created a support ticket pointing to this discussion. It cannot be shared I think but I will let you know about the answer.

[as-ascii]

No answer so far unfortunately and the issue affects billing.

In addition it seems that there is no way to bulk-change visibility of packages using UI, CLI or API. When using GitHub Packages as a binary cache for vcpkg it's a disaster.

[cig0]

It's not what I'd expect from a "prestigious" company as Microsoft is...

[xynydev]

Exactly what I'd expect from a '"prestigious"' company...

[cig0]

This is worse than I thought.

While waiting for this tiny little company with very few resources to contact us, I wrote this Python script that should theoretically fetch the list of packages of type container and then switch the visibility key from private to public.

I wanted to solve the issue you pointed out about both the web UI and the CLI tool lacking the option to bulk-change the visibility of the images.

To that extent, I flipped a few of my packages from public back to private, then ran the script:

import json
import requests

# Replace with your actual values
github_username = "your username"
github_pat = "your GH API key"


def update_package_visibility(package_name, visibility="Public"):
    url = f"https://api.github.com/users/{github_username}/packages/{package_name}"
    headers = {"Authorization": f"token {github_pat}"
    data = {"visibility": visibility}

    response = requests.patch(url, headers=headers, json=data)

    if response.status_code == 200:
        print(f"Successfully updated visibility of {package_name} to {visibility}")
    else:
        print(f"Error updating {package_name}: {response.text}")


# Get list of packages (specifying package_type)
url = f"https://api.github.com/users/{github_username}/packages?package_type=container"
headers = {"Authorization": f"token {github_pat}"}
response = requests.get(url, headers=headers)

if response.status_code == 200:
    packages = response.json()
    print("Package Information:")
    print(packages)

    with open("packages.json", "w") as outfile:
        json.dump(packages, outfile)

    for package in packages:
        package_name = package["name"]
        if package["visibility"] == "Private":
            update_package_visibility(package_name)
else:
    print(f"Error getting list of packages: {response.text}")

(This gets interesting...)

When looking at the JSON object with the list of the packages retrieved, you can see there that the list contains ONLY THE PUBLIC IMAGES!

Oh, dear! 🤣

I got back to the token creation section to see if I was missing something, but I don't think so -- I checked the write:packages checkbox, then the whole repo section is automatically selected:

That's it. I'm sorry I couldn't help you out. For some reason, the web UI is the only way to manage the packages' visibility 💩

I leave the jq command here if it's helpful to you: jq '[.[] | {id, name, package_type, owner: {}, visibility, url, created_at, updated_at, repository: {}, html_url}]' packages.json

[hellodword]

the list contains ONLY THE PUBLIC IMAGES!

That's funny, now I believe it's a BUG of GitHub packages not a feature of billing things.

I hope GitHub could give a response and fix it soon.

---

I created a PAT with all permissions, and confirmed that even I try to patch a specific image name to public without listing packages, the requests always return 404.

[as-ascii]

Private Nuget packages are returned when you try like this for example:

curl -L \
  -H "Accept: application/vnd.github+json" \
  -H "Authorization: Bearer $TOKEN" \
  -H "X-GitHub-Api-Version: 2022-11-28" \
  https://api.github.com/$NAMESPACE/packages?package_type=nuget&visibility=private

but ...
There is no way to change package visibility using API it seems. Error is returned all the time.
Related issue here: https://github.com/orgs/community/discussions/55094

Still no answer to support ticket. I don't know what is estimated time of answer, because I use it very rarely.

[as-ascii]

The Support Team contacted me today with additional questions, I sent more details. "Fingers crossed" :-)

[cig0]

Thanks for keeping us posted! 💪

[tinaheidinger]

Hello from GitHub Packages! We're actively looking into this. I'll keep you posted.

Update: We fixed this for containers. The fix for the other package types is still being worked on.

[hellodword]

Good news, for me, this issue was fixed!