### Context Every day, millions of packages are published and downloaded with the GitLab Package Registry, with around 1/3 of those requests being made with a Deploy token. So, it's critical that they work reliably, so GitLab customers don't have to spend time debugging their pipelines. There have been several issues raised for a variety of formats from developers having problems working with deploy tokens. This epic will aggregate those issues and identify a plan to address the core problems and to communicate clearly with the community in one place. ### Problem to solve At the time of writing this, there are a few known issues with using deploy tokens and the Package Registry: 1. Deploy tokens do not work with sub-groups. 1. Deploy tokens do not work when the permissions of a given project have been updated from private to public. 1. Deploy tokens do not currently work with Composer 1. Deploy tokens do not work with the Packages API. The last item is by design. Deploy tokens are not intended to work with the GitLab API. You can read more about this rationale here: https://gitlab.com/gitlab-org/gitlab/-/issues/5813#note_577221607. ### Proposal Solve the above two problems by scheduling and completing https://gitlab.com/gitlab-org/gitlab/-/issues/285495, which ensure deploy tokens work with sub-groups, and https://gitlab.com/gitlab-org/gitlab/-/issues/329253 which will decouple code repository and package registry permissions and resolve the issue in which project permissions changes break deploy tokens and the package registry. #### Further details Related issues: - [Group-level Deploy Tokens not working with project nuget packages](https://gitlab.com/gitlab-org/gitlab/-/issues/325644#note_602154589) - [Uploading/installing packages to conan package registry not working with deploy tokens](https://gitlab.com/gitlab-org/gitlab/-/issues/332735) - [Nuget package installation with Project Deploy Token returns 403 on Private projects](https://gitlab.com/gitlab-org/gitlab/-/issues/332028#note_589042728) - this was the original investigation that uncovered `2` - [Group deploy tokens not working with LFS](https://gitlab.com/gitlab-org/gitlab/-/issues/235398)