Docs
Search docs

List the registry tags a workflow run pushed

GET/api/workflow-runs/{run_id}/packages

listWorkflowRunPackages

Tags whose latest push came from this run's job token, grouped by package, newest first. A tag a later push re-bound no longer names this run. Authorized as a read of the run's repo (404 otherwise), and each package is then filtered through the pull path's own decision — a run may push to a package its reader cannot pull.

Authentication is not described for this operation in the spec — that does not mean it is public. Check tokens and scopes.

curl

curl -X GET 'https://neosource.dev/api/workflow-runs/RUN_ID/packages'

fetch

fetch("https://neosource.dev/api/workflow-runs/RUN_ID/packages", {
  method: "GET",
});

Path parameters

run_idrequired

string

Responses

200Packages the run pushed

application/json

RunPackageListResponse

object

`GET /api/workflow-runs/{run_id}/packages`. A tag a later push re-bound no longer names this run, so this is what the run's pushes still own.

packagesrequired

array

items

RunPackageResponse

object

One package a run pushed to, with the tags whose latest push was that run.

packagerequired
PackageResponse
tagsrequired

array

Newest push first.

itemsPackageTagResponse

403Forbidden — one of: forbidden, needs_scope

application/json

one of
  • ErrorForbidden

  • NeedsScopeError

    object

    `403` body returned when a classic OAuth token is asked for something its granted scopes do not cover — an explicit private listing without `repo`, or the one-click GitHub mirror without `admin:public_key`. `scope` names the missing grant so the client can say exactly what the token lacks. There is no elevation route to widen it any more (a re-link goes through the GitHub App, whose tokens carry no scopes), so the client's answer is to say so, never to start a handshake.

    errorrequired

    string

    Always `needs_scope` — this body exists to carry the extra fields that kind needs.

    "needs_scope"

    scoperequired

    string

    The provider scope to request via elevation (e.g. `"repo"`).

Standard errors

Bodies documented once for the whole API — see standard errors.

  • 400Bad Request — one of: invalid_input
  • 404Not Found — one of: not_found
  • 429Rate limited — retry after the `Retry-After` header
  • 500Internal server error
  • 503Service temporarily unavailable / at capacity — retry after the `Retry-After` header
  • 504Gateway timeout — the request exceeded the server's handling budget

Schemas

Referenced above. Listed here rather than expanded inline, so the same definition is not repeated at every level.

PackageResponse

object

One registry package. `visibility` is the package's OWN visibility, never the linked repo's: anonymous pull is gated on this field alone (ADR 0097 §4), and a private repo may hold a public package or the reverse.

created_atrequired

integerint64

namerequired

string

The `{package}` path component. Obeys the OCI `path-component` grammar, which is narrower than a repo slug.

ownerrequired

string

Owner handle the package is served under — the `{owner}` in `/v2/{owner}/{package}`.

package_idrequired

string

pull_refrequired

string

What `docker pull` takes, without a tag: `{registry_host}/{owner}/{name}`, where the host is the registry's ADVERTISED hostname (`neocr.io` in production, ADR 0097 §1) — the forge's own host only where no separate registry host is configured.

example"neocr.io/neosource/server"

repo_id

string | null

The optional repo link. `null` for an unlinked package, and on the read routes also when the caller cannot read the linked repo (a public package may link a private one).

updated_atrequired

integerint64

visibilityrequired

RepoVisibilityInput

string

"public""internal""private"

workspace_idrequired

string

PackageTagResponse

object

One tag with the provenance of its latest push. Every provenance field is `null` for a tag bound before provenance was recorded.

digestrequired

string

`sha256:<hex>` — the manifest digest the tag points at.

media_type

string | null

The manifest's `Content-Type` as pushed. An open vocabulary (any OCI or Docker manifest media type), hence a string.

pushed_atrequired

integerint64

When the tag was last pushed (Unix millis).

pushed_by

string | null

Handle of the account the latest push is attributed to; `null` for an actor-less run, a deleted account, a tag predating provenance, or a CI push whose `run` is hidden from the caller.

run
one of

  • PackageTagRun

    object

    The CI run a tag's latest push came from, shown only to a caller who can read that run's repo.

    commit_sha

    string | null

    The commit (40-char git hex) the run built; `null` for a run with no single commit target (a schedule, a legacy manual row).

    ownerrequired

    string

    Handle of the run's repo owner.

    reporequired

    string

    The run's repo slug.

    run_idrequired

    string

  • null

size

integer | nullint64

Manifest size in bytes.

tagrequired

string