GitHub Container Registry (GHCR)

GitHub Container Registry (GHCR) integration setup for Arnica

1. Generate a GitHub Personal Access Token (PAT)

   A GitHub PAT is required because GitHub doesn't currently support GitHub Apps access to container-type packages.

   Please create a Classic PAT with the following permissions:

   • read:org — Required to list organizations the PAT has access to

   • read:packages — Required to list and access packages in these organizations

   • repo — Required to access packages linked to private repositories

   Learn more about creating GitHub PATs

   A classic PAT grants access to all GitHub organizations you belong to. When you connect GHCR, Arnica automatically discovers every organization the token can reach and adds a separate registry integration for each one that has container packages. If you only want to connect specific organizations, use a fine-grained PAT scoped to those organizations instead.

   If your GitHub organization uses SAML single sign-on (SSO), you must authorize the PAT for SSO access. In GitHub, go to Settings > Developer settings > Personal access tokens, find your token, and click Configure SSO to authorize it for the relevant organization. Learn more about authorizing a PAT for SSO.

   If you belong to multiple SSO organizations but only authorize the PAT for one, Arnica will only add that authorized organization. Unauthorized organizations are skipped silently — you won't see an error for them. To add more organizations later, update your PAT's SSO authorization in GitHub and reconnect.

2. In Arnica, click Connect next to GitHub Container Registry (GHCR)

3. Enter an Alias (optional) and the PAT and click OK