Grant workflow GITHUB_TOKEN package-write scope for GHCR image publish

[Copilot]

The Docker workflow was building images successfully but failing on GHCR push with denied: installation not allowed to Create organization package. The workflow token lacked explicit package publish permission for org-scoped GHCR images.

• Root cause

  • build_docker.yml used secrets.GITHUB_TOKEN for docker/login-action, but workflow-level permissions did not grant packages: write.

• Workflow change (minimal)

  • Added top-level permissions in .github/workflows/build_docker.yml:
    • contents: read
    • packages: write
  • Kept existing login/metadata/buildx matrix flow unchanged, so both client and server continue to build and push under:
    • ghcr.io/${{ github.repository }}/${{ matrix.service }}

• Resulting permission model

  • The Actions token now has the required scope to publish container packages to GHCR (subject to org package policy).

permissions:
  contents: read
  packages: write

Original prompt

Fix the failing GitHub Actions workflow in repository AET-DevOps26/w04-template so Docker images are successfully built and pushed to GHCR.

Context:

• Failing workflow run: https://github.com/AET-DevOps26/w04-template/actions/runs/25658652603/job/75313507346
• Workflow file: .github/workflows/build_docker.yml
• Ref with observed failure: fe8016bd66807bc79c38d2c5b87e16ada9e9d9af
• Observed failure from logs:
  • failed to push ghcr.io/aet-devops26/w04-template/client:main: denied: installation not allowed to Create organization package
  • buildx failed with: ERROR: failed to build: failed to solve: failed to push ghcr.io/aet-devops26/w04-template/client:main: denied: installation not allowed to Create organization package

Current workflow details to inspect and update:

• Login step uses docker/login-action@v3 with registry: ghcr.io, username: ${{ github.actor }}, and password: ${{ secrets.GITHUB_TOKEN }}.
• Metadata step builds image names as ghcr.io/${{ github.repository }}/${{ matrix.service }}.
• Build/push step uses docker/build-push-action@v5 with push: true.
• The workflow currently does not declare explicit top-level permissions for package publishing.

Task:

1. Modify the workflow so the GitHub Actions token has the correct permissions to publish Docker images to GHCR.
2. Ensure the workflow still builds and pushes both client and server images.
3. Keep the fix minimal and aligned with GitHub Actions/GHCR best practices.
4. If needed, make any workflow-only changes required for compatibility with GHCR publishing from Actions.
5. Open a pull request with the fix.

Acceptance criteria:

• The workflow includes the required permissions for package publishing.
• The Docker login/build/push flow remains functional.
• The resulting workflow should allow images under the repository/org GHCR namespace to be built and pushed successfully, assuming org settings permit package creation.
• PR description should clearly explain the root cause and the workflow change.

The following is the prior conversation context from the user's chat exploration (may be truncated):

User: Please find a solution for this failing job. Use the logs, job definition, and any referenced files where the failure occurred. Keep your response focused on the solution and include code suggestions when appropriate.

Assistant: The failure is not in the app build itself. The image builds successfully, then the job fails when pushing to GHCR:

• Failing step: .github/workflows/build_docker.yml lines 64–72
• Error: denied: installation not allowed to Create organization package
• Failing image: ghcr.io/aet-devops26/w04-template/client:main

Relevant workflow lines:

• Login uses secrets.GITHUB_TOKEN at .github/workflows/build_docker.yml:38–43
• Push is enabled at .github/workflows/build_docker.yml:64–72

Root cause:
The workflow is trying to publish a package to the organization namespace ghcr.io/aet-devops26/..., but the token used by the workflow is not allowed to create organization packages. This is usually caused by either:

1. the workflow not having explicit packages: write permission, or
2. the organization’s package settings blocking GitHub Actions from creating packages.

Solution:

1) Add package write permission to the workflow

Update .github/workflows/build_docker.yml to grant the job/token permission to push packages.

name: Build Docker Images

on:
  push:

permissions:
  contents: read
  packages: write

jobs:
  test:
    name: Run Java Tests
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v4

      - uses: actions/setup-java@v4
        with:
          java-version: '21'
          distribution: 'temurin'

      - name: Setup Gradle
        uses: gradle/actions/setup-gradle@v4

      - name: Build with Gradle
        run: cd server && ./gradlew build

  build:
    name: Build Docker Images
    needs: test
    runs-on: ubuntu-latest
    strategy:
      matrix:
        service: [client, server]
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          fetch-depth: 0

      - name: Log in to the Container registry
        uses: docker/login-action@v3
        with:
          registry: ghcr.io
          username: ${{ github.actor }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Set up QEMU
        uses: docker/setup-qemu-action@v3
        with:
          platforms: all

      - name: Install Docker Buildx
        id: buildx
        uses: docker/setup-buildx-action@v3

      - name: Extract metadata (tags, labels) for Docker
        id: meta
        uses: docker/metadata-action@v5
        with:
          images: ghcr.io/${{ github.repository }}/${{ matrix.service }}
          tags: |
            type=raw,value=latest,enable={{is_default_branch}}
            type=ref,event=branch
            type=ref,event=pr

      - name: Build and push Docker Image
        uses: docker/build-push...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

*This pull request was created from Copilot chat.*
>