Inconsistent usages of `ACTIONS_ID_TOKEN_REQUEST_TOKEN` and `ACTIONS_RUNTIME_TOKEN`

[jiasli]

Code of Conduct

• [X] I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers

What part(s) of the article would you like to see updated?

First it says using environment variable ACTIONS_ID_TOKEN_REQUEST_TOKEN:

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings

Using environment variables on the runner (ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN).

Later on, it says using ACTIONS_RUNTIME_TOKEN:

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions

Alternatively, you can use the following environment variables to retrieve the token: ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL.

I checked in an actual run and saw they contain the same value, but the document should be consistent on which environment variable should be used.

Additional information

No response

[welcome[bot]]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[nguyenalex836]

@jiasli Thank you for opening this issue! I'll get this triaged for review ✨

[azanhayat]

[maintainer edit for spammy content]

[A111one]

Thanks for

[t-me-c-2093488272-77]

👌

[t-me-c-2093488272-77]

Thanks

[t-me-c-2093488272-77]

Code of Conduct

• [x] I have read and agree to the GitHub Docs project's Code of Conduct

What article on docs.github.com is affected?

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers

What part(s) of the article would you like to see updated?

First it says using environment variable ACTIONS_ID_TOKEN_REQUEST_TOKEN:

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#adding-permissions-settings

Using environment variables on the runner (ACTIONS_ID_TOKEN_REQUEST_URL and ACTIONS_ID_TOKEN_REQUEST_TOKEN).

Later on, it says using ACTIONS_RUNTIME_TOKEN:

https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/configuring-openid-connect-in-cloud-providers#using-custom-actions

Alternatively, you can use the following environment variables to retrieve the token: ACTIONS_RUNTIME_TOKEN, ACTIONS_ID_TOKEN_REQUEST_URL.

I checked in an actual run and saw they contain the same value, but the document should be consistent on which environment variable should be used.

Additional information

No response

[github-actions[bot]]

Thanks for opening an issue! We've triaged this issue for technical review by a subject matter expert :eyes:

[github-actions[bot]]

This is a gentle bump for the docs team that this issue is waiting for technical review.

[lucavallin]

ACTIONS_ID_TOKEN_REQUEST_URL(results) and ACTIONS_ID_TOKEN_REQUEST_TOKEN (results) seem the most common to me based on how they're used in the code and docs. ACTIONS_RUNTIME_TOKEN is used less often and seemingly more for "internal stuff".

This comment is not based on hard science - I'd like @github/actions-runtime opinion on this to be sure.

[jc-clark]

Thanks for chiming in with this info, @lucavallin. Based on this, I think it's okay for us to update this. Since this article is restricted by a CODEOWNERS file, we will transfer this internally and work on this fix.

[docs-bot]

Thank you for opening this issue! Updates to this documentation must be made internally. I have copied your issue to an internal issue, so I will close this issue.