List packages rest api returns empty list bug

[Kemosabert]

Select Topic Area

Bug

Body

I think I might be encountering a bug when using the GitHub REST API (and graphql API as well) to list all container packages. When doing a GET request to https://api.github.com/orgs/{ORG}/packages?package_type=container the API responds with status code 200, but an empty list. However, when I make a request to a container which I know exists, it succesfully returns the object, eg: GET https://api.github.com/orgs/{ORG}/packages/container/{NAME}. In the response I can verify that it's accessible and has the same package type, but it does not get returned. What's even weirder that my private nuget packages are getting returned when calling the endpoint with nuget as the package_type parameter: https://api.github.com/orgs/{ORG}/packages?package_type=nuget.

For authentication I am using a PAT with packages:read permission, it is not expired. SSO authorisation has been granted to the PAT. But since I can get the package details, I assume the token is fine.

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[Fralopala2]

Likely GitHub API bug for listing organization container packages. Try adding &visibility=private or &visibility=internal to the endpoint. If empty, report via support.github.com.

[AnasAli986]

I'm facing the same issue. Using the following headers:
self.headers = { "Authorization": f"Bearer {token}", "Accept": "application/vnd.github.v3+json", "X-GitHub-Api-Version": "2022-11-28" }

The status code is 200, however, im getting an empty list. The api works if I provide the name of the package.

[polarathene]

This works fine for me with the list packages for org endpoint:

# REST API query with classic token (granting `packages:read`) as `GH_TOKEN` env:
# (jq takes any items returned and outputs the selected fields)
$ curl -sL "https://gha:${GH_TOKEN}@api.github.com/orgs/docker-mailserver/packages?package_type=container" | jq '.[] | { package_type, visibility, html_url }'

{
  "package_type": "container",
  "visibility": "public",
  "html_url": "https://github.com/orgs/docker-mailserver/packages/container/package/docker-mailserver"
}

No visibility query parameter available for the direct lookup endpoint:

# Query container package directly:
$ curl -sL "https://gha:${GH_TOKEN}@api.github.com/orgs/docker-mailserver/packages/container/docker-mailserver" | jq '{ package_type, visibility, html_url }'

{
  "package_type": "container",
  "visibility": "public",
  "html_url": "https://github.com/orgs/docker-mailserver/packages/container/package/docker-mailserver"
}

You should probably add context if your repository was not public?

From memory, when I've used some other API in the past for it to work with a private repository required an additional permission granted on the auth token contents:read IIRC (EDIT: That's from fine-grained permissions used in Github Actions workflows rather than classic token permissions it seems).

The list API endpoint doesn't say what the default for visibility is, but when I tried the equivalent users API instead of orgs not providing this query parameter still showed private visibility items in the response, so it should only be relevant to filtering.

You have no public packages of type container for example, but if you had a private one it would be visible when you use your auth token (gh CLI supports the ENV GH_TOKEN/GITHUB_TOKEN):

gh api /users/AnasAli986/packages?package_type=container | jq '.[] | { package_type, visibility, html_url }'

For me the JSON response return is just [] (empty). You only have 3 public repositories, none of which have an image associated to them, so I can't verify the more specific direct query API against that.