Secret names must not start with GITHUB_.

[RSS1102]

Code of Conduct

• I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret

What part(s) of the article would you like to see updated?

Can the docsSecret names must not start with GITHUB_ be reflected in the document? Why is this so?

Can you provide a more detailed explanation here, including an explanation about Secret names must not start with GITHUB_.
(Or perhaps there is an explanation that I haven't found?)

Additional information

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[03don]

Ronaldoo c Tumpang

[nguyenalex836]

@RSS1102 Thanks for opening an issue! I'll get this triaged for review ✨

[subatoi]

Hi @RSS1102, and thank you for raising an issue—

Apologies if I've misinterpreted, but regarding the text in https://docs.github.com/en/actions/security-guides/automatic-token-authentication#about-the-github_token-secret, the important point is that the GITHUB_TOKEN secret is automatically created:

At the start of each workflow job, GitHub automatically creates a unique GITHUB_TOKEN secret to use in your workflow. You can use the GITHUB_TOKEN to authenticate in the workflow job.

Where we separately state "Secret names must not start with GITHUB_", that means that users cannot create tokens themselves with that pattern.

We'll close this in a few days if we don't hear from you: please let us know if I haven't answered your question and thanks again for your issue.

[RSS1102]

GITHUB_TOKEN secret is automatically created

@subatoi
Thank you for your patient explanation. My understanding is not comprehensive enough, I understand now. it meaning is that GITHUB-TOKEN secret is automatically created, so I can directly use GITHUB-TOKEN to run my actions without the need for me to manually create them.

---

Perhaps we should add a reminder on the docs: You can use it without creating it😆😆

[subatoi]

You're very welcome! I'll pass your feedback to the relevant team. Thanks again for your interest in the GitHub docs.

[defidefi5]

This is a rather annoying requirement, given that prefixing env vars with a vendor name such as GITHUB_ is common to make it clear what vendor the env var comes from and to essentially scope all env vars for a particular vendor. I hope it's reconsidered.