2009036 - Unable to change visiblity of ghcr images published by https://github.com/mozilla-services/syncstorage-rs

Status: RESOLVED FIXED

(mozilla.org :: Github: Administration, task)

Description

[Barry Chen]

Attachment: sceenshot of modal to set ghcr package visibility that is restricted to "Private"

The sync storage team wants to start publishing packages to ghcr. However, there appears to be a mozilla-services Github org level setting that keep packages always private. (See attach screenshot.) Preferably we would like the packages to inherit the visibility of the https://github.com/mozilla-services/syncstorage-rs repo itself, which is public. Failing that, we’d like the admins of the repo to have permission to manually set package visibility to public.

Thank you!

Comment 1

[Chris Brentano [:ctb]]

This is a default setting for all orgs based on security's requirements, and is an org-wide setting only unfortunately (can't override per repo).

My reading of the docs today says that container image storage is currently free but it could change in the future, which could be an issue down the road (something to keep in mind). https://docs.github.com/en/enterprise-cloud@latest/billing/concepts/product-billing/github-packages

Needinfo'ing Clovis and Sandeep for sec review.

Comment 2

[Barry Chen]

This is a default setting for all orgs based on security's requirements

Understood, thank you. MozCloud is recommending ghcr in https://mozilla-hub.atlassian.net/wiki/spaces/SRE/pages/1676935173/Standards+Container+Images#Optional-Public-Registries, which is why we are trying it.

Comment 3

[sseehra]

Reviewed & approved. Thanks!

Comment 4

[Chris Brentano [:ctb]]

Thanks Sandeep!

I've enabled the option to publish packages/containers publicly. Barry let me know if that unblocks you here, thanks.

Comment 5

[Barry Chen]

I was able to set a package's visibility to public. Thank you!