From 012ef537776a42d4d68eb9c4a90c51c1d7f2d560 Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Wed, 24 Jun 2026 10:21:36 +0200 Subject: [PATCH 1/2] docs(gh-cli): add GHCR package management + delete scopes Deleting a GHCR org package needs BOTH read:packages and delete:packages; admin:org alone is insufficient. Verify effective token scopes via the X-OAuth-Scopes response header, since gh auth status can lag. Signed-off-by: Sebastian Mendel --- .../references/gh-cli-reference.md | 21 +++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/skills/github-project/references/gh-cli-reference.md b/skills/github-project/references/gh-cli-reference.md index fab9060..bffb9b1 100644 --- a/skills/github-project/references/gh-cli-reference.md +++ b/skills/github-project/references/gh-cli-reference.md @@ -131,6 +131,27 @@ gh release view --repo OWNER/REPO gh release download TAG --repo OWNER/REPO ``` +## Packages (GHCR) + +```bash +# List org container packages +gh api "orgs/ORG/packages?package_type=container" + +# Inspect a package (needs read:packages) +gh api "orgs/ORG/packages/container/PACKAGE" + +# Delete a package — needs BOTH read:packages AND delete:packages. +# admin:org alone is NOT enough; delete:packages alone still 403s. +gh auth refresh -h github.com -s read:packages,delete:packages +gh api --method DELETE "orgs/ORG/packages/container/PACKAGE" # 204; GET then 404 +``` + +Verify the token's effective scopes from GitHub's response header, not `gh auth status` (which can lag): + +```bash +gh api "orgs/ORG/packages/container/PACKAGE" --include 2>&1 | grep -i '^X-Oauth-Scopes:' +``` + ## Files and Content ```bash From e2803f676a80853a611d5e0906471c12174de89f Mon Sep 17 00:00:00 2001 From: Sebastian Mendel Date: Wed, 24 Jun 2026 13:11:04 +0200 Subject: [PATCH 2/2] docs(gh-cli): use -X DELETE and root endpoint for scope check Address review feedback on GHCR package commands: use -X DELETE for consistency with other -X flags in the reference, and query the root API endpoint for X-OAuth-Scopes (always available, no placeholders). Signed-off-by: Sebastian Mendel --- skills/github-project/references/gh-cli-reference.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/skills/github-project/references/gh-cli-reference.md b/skills/github-project/references/gh-cli-reference.md index bffb9b1..408ede7 100644 --- a/skills/github-project/references/gh-cli-reference.md +++ b/skills/github-project/references/gh-cli-reference.md @@ -143,13 +143,13 @@ gh api "orgs/ORG/packages/container/PACKAGE" # Delete a package — needs BOTH read:packages AND delete:packages. # admin:org alone is NOT enough; delete:packages alone still 403s. gh auth refresh -h github.com -s read:packages,delete:packages -gh api --method DELETE "orgs/ORG/packages/container/PACKAGE" # 204; GET then 404 +gh api -X DELETE "orgs/ORG/packages/container/PACKAGE" # 204; GET then 404 ``` Verify the token's effective scopes from GitHub's response header, not `gh auth status` (which can lag): ```bash -gh api "orgs/ORG/packages/container/PACKAGE" --include 2>&1 | grep -i '^X-Oauth-Scopes:' +gh api "" --include 2>&1 | grep -i '^X-Oauth-Scopes:' ``` ## Files and Content