Experiment in using GitHub CLI to authenticate fetching docker images from GitHub Package Registry

README.md

Using the GitHub CLI as a helper for authenticating Docker to ghcr.io

To install this, what worked for me:

1. Install the GitHub CLI using whatever method works best for you; I used brew install gh.
2. Authorize your local system with GitHub with the appropriate scopes:

gh auth refresh --scopes=read:packages,write:packages

3. Save the file docker-credential-gh to somewhere in your path (try /usr/local/bin) and mark it as executable (chmod a+x /usr/local/bin/docker-credential-gh).

4. Edit ~/.docker/config.json and ensure that the config settings as described in the gist above are set properly.

5. Run docker login ghcr.io to verify that authentication is working.

config.json

// ~/.docker/config.json
{
    "credsStore": "desktop",
    "credHelpers": {
        "docker.pkg.github.com": "gh",
        "ghcr.io": "gh"
    }
}

docker-credential-gh

#!/bin/bash
# This "docker-credential-gh" utility should exist an as executable somewhere in PATH.
#
# Dependencies: gh
#
set -e

cmd="$1"
if [ "erase" = "$cmd" ]; then
  cat - >/dev/null
  exit 0
fi
if [ "store" = "$cmd" ]; then
  cat - >/dev/null
  exit 0
fi
if [ "get" != "$cmd" ]; then
  exit 1
fi

host="$(cat -)"
host="${host#https://}"
host="${host%/}"
if [ "$host" != "ghcr.io" ] && [ "$host" != "docker.pkg.github.com" ]; then
  exit 1
fi

token="$(gh config get -h github.com oauth_token)"
if [ -z "$token" ]; then
  exit 1
fi

printf '{"Username":"%s", "Secret":"%s"}\n' "$(gh config get -h github.com user)" "$token"