Switching tap storage from releases to packages

[mahrud]

Description of issue

I'm attempting to switch my tap from storing bottles as GitHub releases to storing them as GitHub packages. However, the pull step is stuck in a loop like this:

2024-03-20T13:09:13.8825711Z /usr/bin/env /usr/bin/skopeo copy --retry-times=3 --format=oci --all oci:gfan--0.6.2_11 docker://ghcr.io/macaulay2/tap/gfan:0.6.2_11 --dest-creds=mahrud:******
2024-03-20T13:09:13.9041021Z Getting image list signatures
2024-03-20T13:09:13.9041767Z Copying 4 of 4 images in list
2024-03-20T13:09:13.9043768Z Copying image sha256:c1fbff0ebd415a5be7d45e1b6c23e0c4a50498df45b661e0662d4a942e5ad464 (1/4)
2024-03-20T13:09:13.9045098Z Getting image source signatures
2024-03-20T13:09:14.1333896Z Copying blob sha256:a6fedea5c6d1cb5a983bb7d49f9b4eb923f3e2fbc31411d335a9579ca348a076
2024-03-20T13:09:14.3208533Z time="2024-03-20T13:09:14Z" level=warning msg="failed, retrying in 1s ... (1/3). Error: writing blob: initiating layer upload to /v2/macaulay2/tap/gfan/blobs/uploads/ in ghcr.io: denied: installation not allowed to Create organization package"

I tried adding permissions: write-all, but that didn't help. Any ideas what is missing?

Here is the PR where I'm attempting the switch, and here's a sample build.

[Bo98]

Because your publish workflow is pull_request_target, it is using the workflow as it's written on main rather than the workflow in your pull request. This is how pull_request_target is designed to work.

So it doesn't have the permission changes you made:

GITHUB_TOKEN Permissions
  Actions: read
  Contents: write
  Metadata: read
  PullRequests: write

[mahrud]

Ah, this makes complete sense. Thank you!