build-push-action: insufficient_scope: authorization failed

hello, if anybody else gets stuck on this like i did, here’s what i did to solve it

i had to fix my tags setting:

    - name: push image - server
      uses: docker/build-push-action@v2
      with:
        file: ./s/Dockerfile
        context: .
        push: true
        tags: ${{ env.REGISTRY }}/${{ github.repository }}/server:${{ github.sha }}

where

• ${{ env.REGISTRY }} is equivalent with ghcr.io (the github packages registry)
• ${{ github.repository }} is equivalent with chase-moskal/xiome (my github name and private repo’s name)
• server is the name i decided for my docker image, since my repo is pushing multiple different images
• ${{ github.sha }} is simply the commit id, which i’m using to identify my staging images (i plan to use git v tags for real production releases)
• thus it computes to something like ghcr.io/chase-moskal/xiome/server:69aa49cd2994f2063f908dd8868f1aa4da2385bddfbc0e069534a7fa5865cb08

this fixed the issue in my case, particularly adding the ghcr.io/ prefix

@AntonioFalcao So it’s a typo in your workflow:

antoniofalcaojf/dotnet5-graphql3-webapi != antoniofalcaojr/dotnet5-graphql3-webapi

OMG! So sorry about that! It’s working now. Thanks!

Strangely enough, I was getting this error because of a mismatch between the name given to a build stage and the name used in a COPY --from=… instruction. I fortunately stumbled on this answer, which got me looking at the FROM and COPY instructions in my Dockerfile.

I feel like incongruencies between build stage names in FROM and COPY instructions could probably be caught by syntax validation before cascading, somehow, to an auth failure.

Hope this helps somebody, I spent way too much time on this snafu.

For me the problem was that I had to login in Docker on the command line: docker login --username=<username>

I had this too, make sure myuser is set to you real docker username; that’s what caused my Action to fail!

@AntonioFalcao So it’s a typo in your workflow:

antoniofalcaojf/dotnet5-graphql3-webapi != antoniofalcaojr/dotnet5-graphql3-webapi

Yes adding context: . fix the problem.

@AntonioFalcao Looks like the same issue as #162 when Git context is used. Can you use the Path context while waiting for a fix?:

name: Push API Image

on:
  push:
    branches: master
  workflow_dispatch:

jobs:
  push_to_registry:
    name: Push Docker image to Docker Hub
    runs-on: ubuntu-latest
    steps:
      -
        name: Checkout
        uses: actions/checkout@v2
      -
        name: Set up QEMU
        uses: docker/setup-qemu-action@v1
      -
        name: Set up Docker Buildx
        uses: docker/setup-buildx-action@v1
      -
        name: Login to DockerHub
        uses: docker/login-action@v1 
        with:
          username: ${{ secrets.DOCKERHUB_USERNAME }}
          password: ${{ secrets.DOCKERHUB_TOKEN }}
      -
        name: Build and push
        id: docker_build
        uses: docker/build-push-action@v2
        with:
          context: .
          file: ./src/Dotnet5.GraphQL3.Store.WebAPI/Dockerfile 
          push: true
          tags: antoniofalcaojf/dotnet5-graphql3-webapi:latest
      -
        name: Image digest
        run: echo ${{ steps.docker_build.outputs.digest }}