Leverage GitHub Actions to publish to GitHub Packages

By Madis Kõosaar
github certification github-packages docker docker-regisitry containers actions

Prepearing for GitHub Certification part 5 - Leverage GitHub Actions to publish to GitHub Packages

Table of Contents

What is GitHub Packages?

  • GitHub Packages is a package management service that makes it easy to publish public or private packages next to your source code.

GitHub Packages is a package registry

  • Allow to share your project dependencies within your org or publicly
  • Make it is easy to find public packages anywhere in GitHub or private packages within your organization or repositories

A standard package manager

  • Compatible with common package management clients
  • Can publish multiple packages of different types *Can customize publishing and post-publishing workflows using webhooks or GH Actions
  • Some Supported package managers:
    • Npm, Nuget, RubyGems, Maven…etc

GitHub Packages is also a container registry

  • Allow publish and distribute container images
  • Once published - images can be used from anywhere
    • Local dev env
    • As a base for Codespaces dev env
    • Step in CI/CD workflow (GH Actions)
    • On server or cloud service

    • Unified identity and permissions

  • Can use a single set of credentials across source code repo, your private NPM registry, and your Maven or Gradle private registry.
  • Packages published through GH inherit visibility and permission assigned and repo

Build and publish packages from GitHub

  • Using GH actions and GH PAckages can create a workflow to build/test and publish by simply pushing code to your repo

Publish to GitHub Packages and GitHub Container Registry

Use a workflow to publish to GitHub Packages

  • Securely publish and consume packages
  • Store alongside your code
  • Share privately or publicly

  • Automate with GH Actions

  • Sample: runs whenever a new release is created, if tests pass then the package is published

{% highlight yml %} name: Node.js Package

on: release: types: [created]

jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 with: node-version: 12 - run: npm ci - run: npm test

publish-gpr: needs: build runs-on: ubuntu-latest steps: - uses: actions/checkout@v2 - uses: actions/setup-node@v1 with: node-version: 12 registry-url: https://npm.pkg.github.com/ - run: npm ci - run: npm publish env: NODE_AUTH_TOKEN: ${{secrets.GITHUB_TOKEN}} {% endhighlight %}

  • Workflow file needs to exist in .github/workflows.

Use GitHub Container Registry to host and manage Docker container images

  • Offers container registry to host and manage Docker images
  • GHCR(GitHub Container Registry) allows to manages access to packages using fine-grained permissions
  • Store Container images with your org and user account rather than a repo
  • Access public container images anonymously
  • Build the image, authenticate, sign in to GHCR at ghcr.io then tag and push your images to the CR using commands below:
echo $PAT | docker login ghcr.io -u USERNAME --password-stdin


docker tag IMAGE_ID ghcr.io/OWNER/IMAGE_NAME:latest


docker push ghcr.io/OWNER/IMAGE_NAME:latest

Note:

  • To Authenticate using GH Actions
    • For package registries PACKAGE-REGISTRY.pkg.github.com, you can use a GITHUB_TOKEN
    • For the container registry ghcr.io/OWNER/IMAGE-NAME, you must use a personal access token

Exercise

Sample Excerise

GitHub Packages for code packages

Authenticating to GitHub Packages

  • you need three pieces of information:
    • Your GitHub username
    • A Personal Access Token
    • The GitHub Packages endpoint for your package ecosystem.

Generate a Personal Access Token

  • To install, publish or delete a package, you need an access token (PAT) - Can be done from your profile settings

Log in into GitHub Packages

  • You need to authenticate in your package manager against GitHub Packages. E.g https://PACKAGE_TYPE.pkg.github.com/OWNER/REPOSITORY, where PACKAGE_TYPE is the type of package ecosystem you're using.
  • To learn more

Installing a package

  • When authenticated you can use published packages
  • Package page shows an example command to run

Managing packages

  • Can manage GitHub Packages through GitHub API and GraphQL API
  • You can use GH Actions to automate package management. EG use delete-package-versions to automatically prune the oldest versions while publishing a new version