A job must run inside a private image 'ghcr.io/acme/ci-node:20'. How do you supply registry credentials for the job container?
Select an answer to reveal the explanation.
Short Explanation and Infographic
job.container.credentials (and the same for services) lets Actions pull private images using secrets-backed username/password.
Full explanation below image
Full Explanation
For private container images used as the job container or service, provide credentials under the container/services mapping. Reference secrets for password/token values; never hardcode. A prior step docker login does not configure the platform's pull of the job container image before steps run. URL-embedded passwords are insecure and unsupported as a best practice. permissions: packages: read helps GITHUB_TOKEN access GitHub packages when the token is the credential, but you still wire credentials appropriately; arbitrary external registries need their own tokens. Rotate registry tokens stored as secrets regularly.