Github Container registry (ghcr.io) packages not appearing in api

[christian-korneck]

Is there any way to query the ghcr type packages using the github api (rest or graphql)?
The ghcr docs have an example of how to delete a ghcr container image version with graphql. That mutation needs the version id of the package - but how can I get that ID (or other infos about the package)?

This graphql query seems to only lists the “old” type of Docker packages (docker.pkg.github.io):

{
  viewer {
    login
    packages(first: 100) {
      edges {
        node {
          id
          name
          packageType
        }
      }
    }
  }
}

Am I looking in the wrong place? Thanks a lot for any advice!

[nohaapav]

Having the same issue. Only old packages using docker.pkg.github.com domain are listed. Although these packages are listed in Github UI so there must be some query to fetch such information. Can you update api docs or share the correct query please ?

[christian-korneck]

anyone any idea? (even if it’s not possible yet to manage ghcr containers via the API it would be great to get a quick confirmation). Thanks!!

[jcansdale]

Hi @christian-korneck,

Sorry about the delay!

christian-korneck:

anyone any idea? (even if it’s not possible yet to manage ghcr containers via the API it would be great to get a quick confirmation). Thanks!!

I’m afraid it isn’t possible to manage ghcr containers via the GraphQL API. The previous registry version was heavily based on GraphQL. This is a very different beast and will likely have a different API.

[nohaapav]

Hi @jcansdale,

is there any ETA for delivery ?

[jcansdale]

nohaapav:

is there any ETA for delivery ?

No specific ETA. I’ve confirmed that the team are working on a REST API for this.

Keep an eye on the change log:
https://github.blog/changelog/

I’ll try to report back here as well!

[christian-korneck]

thanks @jcansdale, I think that answers my question.

[den-is]

same here 😦
that makes migration from docker.pkg.github.com to ghcr.io painful for us.

[WyriHaximus]

Is there a timeline for when we might see this? With the DockerApocalypse coming on Monday this is quickly becoming more and more relevant.

[benc-uk]

Just hit this today when trying to create some automation to clean up old images from GHCR
API support is essential

[whitneyimura]

👋 @benc-uk We’re actively talking about this exact use case, and a delete REST endpoint will likely be the first API we expose to our customers for Container Registry. We are hoping to expose such an endpoint before end of year.

[airtower-luna]

Will you support the Docker Registry API for image deletion, or are you planning something GHCR specific? I think a generic solution would be preferable. Not that I’d mind an additional GHCR API for additional features, of course (especially if it offers something similar to docker image prune)! 😉

[derekbelrose]

Hi Whitney,

Is there any update on this REST endpoint? I would, also, like to be able to modify permissions on an image and, if possible, trigger a GH action when an image has been pushed.

[rubengees]

Hello!

Is there any progress on this? The old repository-bound container package registry is deprecated and the new one does not show up in the GraphQL APIs yet. It would be really helpful to have this so we can automate package deletion. This is actively blocking us from migrating to the new registry and that in terms is blocking us from upgrading to K8s 1.20 which does only work with the new registry.

[jcansdale]

Hi @rubengees,

rubengees:

Is there any progress on this? The old repository-bound container package registry is deprecated and the new one does not show up in the GraphQL APIs yet. It would be really helpful to have this so we can automate package deletion.

Yes, the new REST API has been released!

You can find it here:

docs.github.com

Packages - GitHub Docs

//docs.github.com/en/rest/reference/packages

Here is a blog post about package deletion (including public packages) for all registries:

The GitHub Blog

Packages: delete and restore for all packages - GitHub Changelog

Packages: delete and restore for all packages

Please let me know if you have any further questions.

[benc-uk]

The docs state "GraphQL is not supported for containers or Docker images at ghcr.io"

So how are we supposed to bulk delete many old images in GH Container Registry ?
Click for hours in web UI?

[kc1r74p]

You can use the REST Api like @jcansdale mentioned, this way you can build any automation you want.

I also adjusted the packages action which can now remove old versions from ghcr.
Related issue with PoC: Cannot read property 'packages' of null · Issue #28 · actions/delete-package-versions · GitHub

However I just opened a thread here where I am wondering if we can also use the GITHUB_TOKEN instead of a Personal Access Token.

<a href="https://github.community/t/github-token-has-no-access-to-new-container-rest-apis/170395">Github token has no access to new container REST APIs</a> <a class="badge-wrapper  bullet" href="/https/github.com/c/code-to-cloud/github-packages/43"><span class="badge-category-parent-bg" style="background-color: #6a737d;"></span><span class="badge-category-bg" style="background-color: #005cc5;"></span><span style="" data-drop-close="true" class="badge-category clear-badge" title="Any questions related to GitHub Packages and how to manage your packages; upload, download, and delete. Happy to see questions about our help docs and the core set of clients and services we support but also questions about configuring and using alternate clients are welcome.">GitHub Packages</span></a>

Hello, I just saw the changelog entry which now introduced access for the container registry. There it mentions that the secrets.GITHUB_TOKEN now has full access including reading and deleting for the ghcr registry. However, switching from PAT to the GITHUB_TOKEN and adding permissions (push works fine with new token), now my custom action to list and then delete containers from ghcr.io throws:

HttpError: Resource not accessible by integration

when using following API with a non PAT token…

Best regards
Patrick