is there a way (or plans) to allow the use of fine grained PATs to READ github packages

[dmitry-mightydevops]

Select Topic Area

Bug

Body

I don't see any permission scope for packages in the settings.
I gave Read access to code and metadata fir a fine grained PAT

<?xml version="1.0" encoding="utf-8"?>
<configuration>
    <packageSources>
        <clear />
        <add key="github" value="https://nuget.pkg.github.com/GH-ORG/index.json" />
    </packageSources>
    <packageSourceCredentials>
        <github>
            <add key="Username" value="token" />
            <add key="ClearTextPassword" value="github_pat_11" />
        </github>
    </packageSourceCredentials>
</configuration>

results: 403 Error

➜ dotnet add package Project.Name.Domain --version 0.0.1
  Determining projects to restore...
  Writing /tmp/tmpSgvtnp.tmp
info : X.509 certificate chain validation will use the system certificate bundle at '/etc/pki/ca-trust/extracted/pem/objsign-ca-bundle.pem'.
info : X.509 certificate chain validation will use the fallback certificate bundle at '/usr/share/dotnet/sdk/7.0.203/trustedroots/timestampctl.pem'.
...
info :   NotFound https://nuget.pkg.github.com/GH_ORG/download/microsoft.aspnetcore.identity.entityframeworkcore/index.json 370ms
info :   NotFound https://nuget.pkg.github.com/GH_ORG/download/microsoft.aspnetcore.authentication.jwtbearer/index.json 378ms
info :   NotFound https://nuget.pkg.github.com/GH_ORG/download/microsoft.entityframeworkcore.design/index.json 378ms
info :   NotFound https://nuget.pkg.github.com/GH_ORG/download/mcmaster.extensions.hosting.commandline/index.json 381ms
info :   NotFound https://nuget.pkg.github.com/GH_ORG/download/microsoft.aspnetcore.dataprotection.entityframeworkcore/index.json 384ms
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 480ms
log  : Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
log  : Response status code does not indicate success: 403 (Forbidden).
info :   GET https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 187ms
log  : Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
log  : Response status code does not indicate success: 403 (Forbidden).
info :   GET https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 220ms
log  : Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
log  : Response status code does not indicate success: 403 (Forbidden).
info :   GET https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 166ms
log  : Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
log  : Response status code does not indicate success: 403 (Forbidden).
info :   GET https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 188ms
log  : Retrying 'FindPackagesByIdAsync' for source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
log  : Response status code does not indicate success: 403 (Forbidden).
info :   GET https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json
warn : Your request could not be authenticated by the GitHub Packages service. Please ensure your access token is valid and has the appropriate scopes configured.
info :   Forbidden https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json 189ms
error: NU1301: Failed to retrieve information about 'project.name.Domain' from remote source 'https://nuget.pkg.github.com/GH_ORG/download/project.name.domain/index.json'.
info : Package 'project.name.Domain' is compatible with all the specified frameworks in project '/home/dmitry/Projects/project-name/project-name-backend/src/project.name.Web/project.name.Web.csproj'.
error: Value cannot be null. (Parameter 'version')

1. is it the only way to add a paid github user, join to the org, grant it access to proper repos (service account) just to handle such requests?
2. was exclusion of pkgs from fine-grained PATs (beta) intentional and if so why?

[otter-computer]

Only classic personal access tokens are supported at the moment, see this note in the documentation.

Fine-grained tokens are still in beta so there is still some features that aren't yet supported, with Packages being one of them. Unfortunately I can't really give you a timeline on when support for fine-grained tokens will be released but if there's more news to share I'll be sure to post it to the community as soon as I hear.

[wyattverdrell173-blip666]

Only classic personal access tokens are supported at the moment, see this note in the documentation.

Fine-grained tokens are still in beta so there is still some features that aren't yet supported, with Packages being one of them. Unfortunately I can't really give you a timeline on when support for fine-grained tokens will be released but if there's more news to share I'll be sure to post it to the community as soon as I hear.

[dmuiX]

they are in beta since 3 years wtf?! This is ridiculous
are you going to integrate package scope any time soon?!