Authenticating within a workflow
The workflow examples throughout this book often show ${{ secrets.GITHUB_TOKEN }}. Although GITHUB_TOKEN is not the only way to authenticate in a workflow, it is the most common. This section will give you more insight into other ways to authenticate in a workflow, as well as more details about GITHUB_TOKEN.
Overview
When you enable GitHub Actions in your repository, GitHub automatically does two things: it installs a GitHub App on your repository and creates a GITHUB_TOKEN. GITHUB_TOKEN works as a GitHub App token, which means that you can use it to authenticate on behalf of the GitHub App. GITHUB_TOKEN is short-lived and expires when the job is finished. GitHub then obtains an installation access token for the next job before the job starts.
Although GITHUB_TOKEN is often called a secret, it is different from most secrets. While you need to add environment secrets to the settings of your repository, as shown in Chapter 2, Deep Diving into...