diff --git a/data/reusables/package_registry/authenticate-to-container-registry-steps.md b/data/reusables/package_registry/authenticate-to-container-registry-steps.md index bc748abafc20..c952e122a5fd 100644 --- a/data/reusables/package_registry/authenticate-to-container-registry-steps.md +++ b/data/reusables/package_registry/authenticate-to-container-registry-steps.md @@ -1,7 +1,7 @@ 1. Create a new personal access token (PAT) with the appropriate scopes for the tasks you want to accomplish. If your organization requires SSO, you must enable SSO for your new token. {% warning %} - **Note:** If you select the `write:packages` scope, deselect the `repo` scope when creating the PAT. Adding a PAT with the `repo` scope as a secret in your repository allows the credential to be accessible to all collaborators in the repository. This gives unnecessary additional access when a PAT with the `repo` scope is used within an action. For more information on security best practices for actions, see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." + **Note:** If you select the `write:packages` scope, deselect the `repo` scope when creating the PAT (Currently not possible on PAT creation, but there is a work-around, edit the PAT after creating it to deselect repo. See [this](https://github.community/t/how-to-create-a-pat-with-write-packages-and-without-repo-permissions/149416) for more information). Adding a PAT with the `repo` scope as a secret in your repository allows the credential to be accessible to all collaborators in the repository. This gives unnecessary additional access when a PAT with the `repo` scope is used within an action. For more information on security best practices for actions, see "[Security hardening for GitHub Actions](/actions/getting-started-with-github-actions/security-hardening-for-github-actions#considering-cross-repository-access)." {% endwarning %}