Post #2965860
2026-05-13 20:21 UTC
GitHub Actions token format `ghs_APPID_JWT` (~520 chars, variable length).
Regex
NEW: `ghs_[0-9]+_[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+`
https://github.blog/changelog/2026-04-24-notice-about-upcoming-new-format-for-github-app-installation-tokens/#how-to-prepare-for-this-change
OLD: `ghs_[A-Za-z0-9]{36}`
https://github.blog/changelog/2021-03-04-authentication-token-format-updates/
#GitHub #GitHubAction #GitHubServerToken #GitHubToken #Regex
Replies (1)
-
@zimzat@mastodon.social 2026-05-14 11:53
@ghostwriter@phpc.social The post about the new format seems to suggest using any format check against the new one is Bad™️ and, beyond the prefix, should be treated as an opaque string.