Question

A developer on your team is debugging a workflow that calls the GitHub REST API using the automatically-provided GITHUB_TOKEN. They want to save the token value from one workflow run and reuse it later from a local script to avoid re-triggering the workflow. As the security reviewer, how should you respond regarding the nature of GITHUB_TOKEN?

Accepted Answer

The GITHUB_TOKEN is ephemeral and its installation credential is automatically revoked when the job completes (or after a maximum of 24 hours), so it cannot be reused outside the run.

Answer

The GITHUB_TOKEN persists for the lifetime of the repository and can be safely stored and reused from external scripts until it is manually rotated.

Answer

The GITHUB_TOKEN is equivalent to a personal access token (PAT) and inherits the full account permissions of the user who triggered the workflow.

Answer

The GITHUB_TOKEN never expires but is scoped only to read operations, so reusing it externally poses no write risk.