Match GITHUB_TOKEN lifetime and recursive-trigger behavior

[gjkim42]

Context

GitHub creates a unique GITHUB_TOKEN for each job, keeps it usable for the documented effective job lifetime, and suppresses most workflow runs caused by that token. The documented dispatch and pull request exceptions still create runs under their specified rules.

Open Actions injects one GitHub App installation token immediately before creating the job Pod. Installation tokens expire after one hour and are not refreshed, so longer valid jobs lose authentication. Events produced with this token are ordinary GitHub App events and can recursively trigger Open Actions workflows.

Goal

Give github.token and secrets.GITHUB_TOKEN the documented GitHub Actions lifetime, scope, revocation, and workflow-trigger behavior.

Acceptance criteria

• Keep each job token valid for the documented effective job lifetime, subject to the GitHub installation-token refresh ceiling.
• Refresh credentials without exposing a broader or cross-job token and make refreshed credentials available through both documented contexts.
• Stop issuing or refreshing credentials as soon as the job reaches a terminal state and revoke outstanding tokens where supported.
• Attribute webhook events created with an Open Actions job token and suppress or allow resulting runs according to the current GitHub GITHUB_TOKEN rules.
• Preserve the documented workflow_dispatch, repository_dispatch, and pull request exceptions rather than applying blanket suppression.
• Do not suppress unrelated events created by the configured GitHub App outside an Open Actions job.
• Preserve effective workflow and job permission narrowing across refreshes.
• Add tests for jobs crossing token expiry, cancellation during refresh, revocation, push recursion, dispatch exceptions, pull request exceptions, and non-job App events.
• Update the token documentation to describe compatible behavior and operational limits.

Reference: https://docs.github.com/en/actions/concepts/security/github_token

[kelos-bot]

🤖 Kelos Task Status

Task open-actions-triage-issues-33bbeb557a6c has failed. ❌