> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# GitHub Container Registry

> Scan container images stored in GitHub Container Registry (GHCR).

**GitHub Container Registry (GHCR)** is GitHub's container registry for Docker images. CybeDefend integrates with GHCR to scan public and internal container images.

<Note>
  **Supported Image Visibility:**

  * ✅ **Public** images - Accessible to everyone
  * ✅ **Internal** images - Accessible within your organization
  * ❌ **Private** images - Not supported by CybeDefend
</Note>

## CybeDefend Configuration

<Warning>
  **Personal Access Token Required:** A Personal Access Token with `read:packages` scope is required to scan internal container images. Public images can be scanned without authentication.
</Warning>

| Field                     | Description                                                          | Example                      |
| ------------------------- | -------------------------------------------------------------------- | ---------------------------- |
| **GitHub Username**       | Your GitHub username or organization                                 | `myorg`                      |
| **Personal Access Token** | GitHub PAT with `read:packages` scope (required for internal images) | `ghp_xxxxxxxxxxxx`           |
| **Description**           | Optional description for the registry                                | `Production GitHub Registry` |

## How to Create a Personal Access Token (PAT) in GitHub

<Info>
  A Personal Access Token with the `read:packages` scope is **required** to scan internal container images. Public images can be accessed without authentication.
</Info>

<Steps>
  <Step title="Access GitHub Settings">
    Go to GitHub → **Settings** → **Developer settings** → **Personal access tokens** → **Tokens (classic)**
  </Step>

  <Step title="Generate New Token">
    Click **Generate new token** and select **Generate new token (classic)**
  </Step>

  <Step title="Select Scopes">
    Select the required scopes for internal container images:

    * ✅ `read:packages` (required for internal images)
    * Optional: `write:packages` (if you need write access)
  </Step>

  <Step title="Copy Token">
    Copy the generated token and paste it in CybeDefend
  </Step>
</Steps>

<Warning>
  The Personal Access Token is only displayed once when created. Make sure to copy it immediately before leaving the page.
</Warning>

## Security Best Practices

<CardGroup cols={2}>
  <Card title="Use Fine-Grained Tokens" icon="fingerprint">
    Prefer fine-grained PATs over classic tokens when possible for better security.
  </Card>

  <Card title="Minimal Scopes" icon="shield-halved">
    Only grant `read:packages` scope for scanning operations.
  </Card>

  <Card title="Set Expiration" icon="calendar-xmark">
    Always set an expiration date for your tokens to limit exposure.
  </Card>

  <Card title="Rotate Tokens Regularly" icon="rotate">
    Change your access tokens periodically to minimize security risks.
  </Card>
</CardGroup>

## Troubleshooting

<AccordionGroup>
  <Accordion title="Authentication Failed" icon="circle-exclamation">
    * Verify the PAT has `read:packages` scope
    * Check if the token has expired
    * Ensure the username matches the token owner
  </Accordion>

  <Accordion title="Permission Denied" icon="ban">
    * Verify you have access to the repository
    * Check package visibility settings
    * Ensure organization membership for internal packages
  </Accordion>

  <Accordion title="Private Images Not Accessible" icon="eye-slash">
    * Private container images are not supported by CybeDefend
    * Change image visibility to **Internal** or **Public** to enable scanning
    * Contact your GitHub admin to modify package visibility settings
  </Accordion>
</AccordionGroup>