Add GHCR package management to gh-CLI reference#93
Conversation
Deleting a GHCR org package needs BOTH read:packages and delete:packages; admin:org alone is insufficient. Verify effective token scopes via the X-OAuth-Scopes response header, since gh auth status can lag. Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
github-actions
Bot
added
documentation
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request adds a new "Packages (GHCR)" section to the GitHub CLI reference guide, documenting commands for listing, inspecting, and deleting container packages, as well as verifying OAuth scopes. The review feedback suggests using -X DELETE instead of --method DELETE for consistency with other commands in the document, and querying the root API endpoint instead of a specific package endpoint to check effective OAuth scopes more reliably.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
Address review feedback on GHCR package commands: use -X DELETE for consistency with other -X flags in the reference, and query the root API endpoint for X-OAuth-Scopes (always available, no placeholders). Signed-off-by: Sebastian Mendel <github@sebastianmendel.de>
|
Why
When deleting a GHCR org container package via the API, the required token scopes are not obvious:
admin:orgalone is not sufficient, anddelete:packageson its own still 403s. The deletion needs bothread:packagesanddelete:packages.gh auth statuscan also lag behind the token's actual scopes, making the failure confusing to diagnose.What
Adds a new Packages (GHCR) section to
skills/github-project/references/gh-cli-reference.md, placed right after "Releases and Tags". It covers:read:packages)read:packages+delete:packages)X-OAuth-Scopesresponse header rather thangh auth statusReference file only —
SKILL.mdis untouched to stay under its word cap.