Read access to packages from a Lattice App installation token?

I am building a Lattice App that needs to pull container images from the packages registry of the repositories it is installed on.

Looking at the list of app permissions, I cannot find one that grants package read access. contents: read lets me clone, but docker pull with the installation token returns:

Error response from daemon: denied: permission_denied: read_package

Is there a permission I am missing, or is this not supported yet?

Hi @mbellweather — thanks for the clear report.

Package permissions are not available to Lattice Apps today; installation tokens can only reach packages that are public. This is a known gap and we have shared your use case with the packages team.

As a workaround, a fine-grained personal token with packages: read scoped to the organization works, though it is tied to a user.

Same problem here — our deploy app has to keep a bot user's token around just for this. Not great for audits.

+1. We rotate the bot token monthly and it is our most common deploy failure.

Any update on this? It has been a while.

No date yet, but it is now on the packages roadmap for this half. We will post here when it ships.

For anyone landing here: you can at least scope the workaround token down. We use a dedicated machine user with only packages: read and set it to expire every 30 days:

lattice token create --name deploy-pull --scope packages:read --expires 30d

Thanks @rafaelcosta, that is a cleaner workaround than ours.

Does the same limitation apply to the npm registry, or only containers?

All package types — it is the permission that is missing, not the registry.

Would love an actions-style packages: read on the app manifest. Even read-only would solve 90% of cases.

Another vote. We are about to move off our bot account and this is the last blocker.

Quick update: package read permission for Lattice Apps is now in private beta. If you want in, reply here with your organization name and we will enable it.

# app manifest
permissions:
  contents: read
  packages: read   # beta

Amazing — please add acme-tools. Thank you!

Please add dataforge. 🙏

Enabled for us yesterday and it works exactly as expected — docker pull with the installation token succeeds.