GITHUB_TOKEN GHCR push "denied" without packages: write in CI

By Kaveh Alemi·Latchkey

Pushing a container image to ghcr.io with GITHUB_TOKEN requires packages: write. Without it the registry returns a denied error during the push, even though docker login appeared to succeed.

What this error means

A docker push to ghcr.io fails with "denied: permission_denied" or "denied: installation not allowed to Create organization package", and the job has no packages: write.

denied: permission_denied: write_package
# or
denied: installation not allowed to Create organization package

Common causes

GITHUB_TOKEN lacks packages: write

The push needs write access to GitHub Packages; without the scope the registry rejects the upload.

Org package settings block the token

Org-level package creation policy can refuse the Actions token from creating a new package.

How to fix it

Grant packages: write

1. Add packages: write to the job permissions.
2. Log in to ghcr.io with GITHUB_TOKEN.
3. Re-run the push.

permissions:
  contents: read
  packages: write

Allow Actions to manage the package

For org packages, ensure the package or org settings allow the repository's Actions to write, or pre-create the package and link the repo.

# Package settings > Manage Actions access
# add the repository with Write role

How to prevent it

• Grant packages: write for image pushes to GHCR.
• Link the package to the repo with Write access for org packages.
• Log in with GITHUB_TOKEN, not a stale PAT.

Frequently asked questions

Related guides

References

• GitHub Actions documentation
• Workflow syntax for GitHub Actions