GitHub Tokens: Test the Whole Handling Path
The 2 October completion notice says its self-contained installation-token rollout is complete. New eligible ghs_ tokens vary around 520 characters, up from 40. The existing rights, repository limits, one-hour expiry and issuing endpoint still apply.
Follow the token
Check validators, storage, proxy headers and masking. Fixed 40-character rules may reject, truncate or fail to redact the new form. These are risks to test, not reported failures or a disclosed leak.
Keep the scope and deadline clear
The April announcement covers Enterprise Cloud and Data Residency, includes Actions GITHUB_TOKEN and excludes Enterprise Server. Clients must not validate the JWT or depend on its contents. The service will stop respecting the temporary X-GitHub-Stateless-S2S-Token header after 30 November 2026 and advises removing it after validating both formats, before that date.
The issuance guide still describes gradual deployment. The newer dated notice establishes completion.
