REST API endpoint needed for managing package repository/Actions access

[danielgerlag]

Summary

There is no REST API or GraphQL mutation to programmatically manage the "Manage Actions access" setting on GitHub Container Registry (GHCR) packages. This setting allows granting specific repositories access to a package for use in GitHub Actions workflows.

Problem

When an organization has many container packages (e.g., 20+), granting a repository Actions access to each package requires clicking through the web UI one-by-one — navigating to each package's settings page, clicking "Add Repository", searching, and confirming. This is extremely tedious and error-prone.

The GitHub REST API documents endpoints for listing, getting, deleting, and restoring packages (/orgs/{org}/packages/container/{name}), but there is no endpoint to:

• Add a repository to a package's Actions access list
• Remove a repository from a package's Actions access list
• List which repositories have Actions access to a package

Expected Behavior

A REST API endpoint such as:

PUT /orgs/{org}/packages/container/{package_name}/repository/{repository_id}
DELETE /orgs/{org}/packages/container/{package_name}/repository/{repository_id}
GET /orgs/{org}/packages/container/{package_name}/repositories

This would allow automation of package access management, which is essential for organizations with many packages and repositories.

Use Case

Our organization has 100+ container packages on GHCR. We needed to grant a single repository Actions access to ~21 packages matching source/*, reaction/*, and bootstrap/*. This required manually clicking through 21 package settings pages in the web UI because no API exists to automate this.

Impact

• DevOps automation: Cannot script package access as part of CI/CD setup
• Org management: Adding a new repo that needs package access requires manual UI work for every single package
• Consistency: Manual process is error-prone; easy to miss a package
• Scale: Gets worse as the number of packages grows

Please consider adding REST API endpoints for managing package repository/Actions access. Thank you!

[shivrajcodez]

Completely agree with this. Managing Actions access for GHCR packages through the UI becomes painful once you have more than a handful of packages.

In larger orgs where repositories and container packages grow quickly, this turns into repetitive manual work that should really be automated. Being able to add/remove repositories or list access through the API would make it much easier to integrate package permissions into CI/CD setup scripts or infrastructure automation.

Right now the only practical option is clicking through every package’s settings page, which doesn’t scale well. API support for this would definitely help teams managing a lot of images.