Skip to content

Invalid argument error by requesting packages for an organization #9606

Description

@pukanszkypeter-acn

Describe the bug

If i would like to list packages for an organization with package type container, i get an error about an invalid argument. This happens in a GitHub action workflow. I don't think it's an authorization issue, because i tried with other package types (npm, docker) and it works just like fine. What am i missing?

$ gh --version
gh version 2.55.0 (2024-08-20)
https://github.com/cli/cli/releases/tag/v2.55.0

Steps to reproduce the behavior

  1. Workflow job:
get-images:
    runs-on: ubuntu-latest
    steps:
      - name: Get iamges
        run: |
          gh api -H "Accept: application/vnd.github+json" -H "X-GitHub-Api-Version: 2022-11-28" "/orgs/${ORG}/packages?package_type=container"
  1. Error:
gh: Invalid argument. (HTTP 400)
{"message":"Invalid argument.","documentation_url":"https://docs.github.com/rest/packages/packages#list-packages-for-an-organization","status":"400"}
Error: Process completed with exit code 1.

Expected vs actual behavior

The container type packages should be listed correctly.

Logs

Paste the activity from your command line. Redact if needed.

Activity

  1. andre-s-pedrosa-alb commented on Sep 16, 2024

    @andre-s-pedrosa-alb

    Also having the same issue, although I'm performing the request via curl, but I have the same value on the X-GitHub-Api-Version header
    The strange thing is that by performing the exact same command on my local computer I get a 200

  2. andyfeller commented on Sep 16, 2024

    @andyfeller
    Contributor

    @pukanszkypeter-x @andre-s-pedrosa-alb : thanks for following up on this issue! let's see how we can set your straight. 🤔

    Questions

    1. What happens if you change ${ORG} in your example?

      This looks like an env var within a shell environment, however I don't know where you're setting this. You can try creating the env var via env field on the step from the GitHub Actions github context

    2. How are you authenticating to gh when trying to access this information? What scopes are available in gh auth status?

      GitHub Packages is somewhat an umbrella for the various package managers that GitHub supports, each with different degree of permissions based on org-based or repo-based packages. I want to make sure you have the necessary permissions.

      For the List packages for an organization, it mentions specifics too:

      OAuth app tokens and personal access tokens (classic) need the read:packages scope to use this endpoint. If the package_type belongs to a GitHub Packages registry that only supports repository-scoped permissions, the repo scope is also required. For the list of these registries, see "About permissions for GitHub Packages."

      For more information, see https://docs.github.com/en/packages/learn-github-packages/about-permissions-for-github-packages

    3. What happens if you execute gh api -X GET /orgs/aws/packages -f package_type=container

      $ gh api "/orgs/aws/packages?package_type=container" -X GET -F per_page=1
      [
        {
          "id": 1074916,
          "name": "aws-cloud-map-mcs-controller-for-k8s",
          "package_type": "container",
          "owner": {
            "login": "aws",
            "id": 2232217,
            "node_id": "MDEyOk9yZ2FuaXphdGlvbjIyMzIyMTc=",
            "avatar_url": "https://avatars.githubusercontent.com/u/2232217?v=4",
            "gravatar_id": "",
            "url": "https://api.github.com/users/aws",
            "html_url": "https://github.com/aws",
            "followers_url": "https://api.github.com/users/aws/followers",
            "following_url": "https://api.github.com/users/aws/following{/other_user}",
            "gists_url": "https://api.github.com/users/aws/gists{/gist_id}",
            "starred_url": "https://api.github.com/users/aws/starred{/owner}{/repo}",
            "subscriptions_url": "https://api.github.com/users/aws/subscriptions",
            "organizations_url": "https://api.github.com/users/aws/orgs",
            "repos_url": "https://api.github.com/users/aws/repos",
            "events_url": "https://api.github.com/users/aws/events{/privacy}",
            "received_events_url": "https://api.github.com/users/aws/received_events",
            "type": "Organization",
            "site_admin": false
          },
          "visibility": "public",
          "url": "https://api.github.com/orgs/aws/packages/container/aws-cloud-map-mcs-controller-for-k8s",
          "created_at": "2021-10-09T04:56:37Z",
          "updated_at": "2024-02-13T19:04:07Z",
          "repository": {
            "id": 408620399,
            "node_id": "MDEwOlJlcG9zaXRvcnk0MDg2MjAzOTk=",
            "name": "aws-cloud-map-mcs-controller-for-k8s",
            "full_name": "aws/aws-cloud-map-mcs-controller-for-k8s",
            "private": false,
            "owner": {
              "login": "aws",
              "id": 2232217,
              "node_id": "MDEyOk9yZ2FuaXphdGlvbjIyMzIyMTc=",
              "avatar_url": "https://avatars.githubusercontent.com/u/2232217?v=4",
              "gravatar_id": "",
              "url": "https://api.github.com/users/aws",
              "html_url": "https://github.com/aws",
              "followers_url": "https://api.github.com/users/aws/followers",
              "following_url": "https://api.github.com/users/aws/following{/other_user}",
              "gists_url": "https://api.github.com/users/aws/gists{/gist_id}",
              "starred_url": "https://api.github.com/users/aws/starred{/owner}{/repo}",
              "subscriptions_url": "https://api.github.com/users/aws/subscriptions",
              "organizations_url": "https://api.github.com/users/aws/orgs",
              "repos_url": "https://api.github.com/users/aws/repos",
              "events_url": "https://api.github.com/users/aws/events{/privacy}",
              "received_events_url": "https://api.github.com/users/aws/received_events",
              "type": "Organization",
              "site_admin": false
            },
            "html_url": "https://github.com/aws/aws-cloud-map-mcs-controller-for-k8s",
            "description": "K8s controller implementing Multi-Cluster Services API based on AWS Cloud Map.",
            "fork": false,
            "url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s",
            "forks_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/forks",
            "keys_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/keys{/key_id}",
            "collaborators_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/collaborators{/collaborator}",
            "teams_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/teams",
            "hooks_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/hooks",
            "issue_events_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/issues/events{/number}",
            "events_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/events",
            "assignees_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/assignees{/user}",
            "branches_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/branches{/branch}",
            "tags_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/tags",
            "blobs_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/git/blobs{/sha}",
            "git_tags_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/git/tags{/sha}",
            "git_refs_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/git/refs{/sha}",
            "trees_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/git/trees{/sha}",
            "statuses_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/statuses/{sha}",
            "languages_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/languages",
            "stargazers_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/stargazers",
            "contributors_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/contributors",
            "subscribers_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/subscribers",
            "subscription_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/subscription",
            "commits_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/commits{/sha}",
            "git_commits_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/git/commits{/sha}",
            "comments_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/comments{/number}",
            "issue_comment_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/issues/comments{/number}",
            "contents_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/contents/{+path}",
            "compare_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/compare/{base}...{head}",
            "merges_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/merges",
            "archive_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/{archive_format}{/ref}",
            "downloads_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/downloads",
            "issues_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/issues{/number}",
            "pulls_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/pulls{/number}",
            "milestones_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/milestones{/number}",
            "notifications_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/notifications{?since,all,participating}",
            "labels_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/labels{/name}",
            "releases_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/releases{/id}",
            "deployments_url": "https://api.github.com/repos/aws/aws-cloud-map-mcs-controller-for-k8s/deployments"
          },
          "html_url": "https://github.com/orgs/aws/packages/container/package/aws-cloud-map-mcs-controller-for-k8s"
        }
  3. eliot-pitman-bah commented on Sep 17, 2024

    @eliot-pitman-bah

    I am getting the same issue via curl

  4. Mathieu-Ferraton commented on Oct 21, 2024

    @Mathieu-Ferraton

    @andyfeller

    Same issue with both curl and gh api:

    Answers to your questions:

    1. hard-coding the ORG field doe not fix the issue
    2. I am using my organization provided $GH_TOKEN (granting write/delete:packages permissions)
    $ gh auth status
    github.com
      ✓ Logged in to github.com account github-actions[bot] (GH_TOKEN)
      - Active account: true
      - Git operations protocol: https
      - Token: ghs_************************************
    

    Deleting packages using this token works just fine, so I would expect listing to be OK

    $ gh api --method DELETE \
        orgs/$ORG/packages/container/$PACKAGE/versions/$ID
    

    -> works

    $ gh api -X GET /orgs/aws/packages -f package_type=container
    gh: Invalid argument. (HTTP 400)
    {"message":"Invalid argument.","documentation_url":"https://docs.github.com/rest/packages/packages#list-packages-for-an-organization","status":"400"}
    

    All requests performed from my local workstation using PAT work just fine.

    I hope this helps...

  5. andyfeller commented on Oct 23, 2024

    @andyfeller
    Contributor

    @Mathieu-Ferraton : Thank you for the additional details, this definitely does help!

    Good news, bad news time:

    • This apparently is a known limitation behind this endpoint using the GitHub Actions automatic token
    • There is an issue on the package registry team's backlog but no idea on timeframe when it will be addressed
    • Cases like this have required a workaround of using a PAT when working with GitHub Packages

    Sadly, the endpoint doesn't provide a helpful response for the type of token used. 😞

    Beyond this bit of help, I don't think there is anything the GitHub CLI through gh api can do to improve the situation as this is a pure GitHub API endpoint issue.

  6. MarkIannucci commented on Nov 7, 2024

    @MarkIannucci

    @andyfeller , thank you for the honesty here. Do you know if we will run into the same error if we use a GH App token as recommended instead of the PAT?

  7. MarkIannucci commented on Nov 7, 2024

    @MarkIannucci

    Self answering my question above... I tested it out and received the same error. Can you share this feedback with the registry team?

  8. MarkIannucci commented on Nov 7, 2024

    @MarkIannucci

    I also tried using a fine grained access token and there isn't a scope for packages which is tracked in github/roadmap#558. So it looks like the only way to do this is to use a classic PAT :⁠-⁠[

  9. andyfeller commented on Nov 8, 2024

    @andyfeller
    Contributor

    @MarkIannucci : I'm pretty sure this is limited to only classic PATs at the moment as explained in About scopes and permissions for package registries; so no fine-grained PAT, no automatic token in GitHub Actions, no GitHub or OAuth app.

    To use or manage a package hosted by a package registry, you must use a personal access token (classic) with the appropriate scope, and your personal account must have appropriate permissions.

    Self answering my question above... I tested it out and received the same error. Can you share this feedback with the registry team?

    🖖 I'm sure this is a well known limitation but will do. Sadly, I don't know where this is on their priority as all of the Packages items on the public roadmap are in the Future column.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workinggh-apirelating to the gh api commandmore-info-neededMore info needed from user/contributorneeds-triageneeds to be reviewed

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions