Environment variable docs are inconsistent about GITHUB_ prefix

[nex3]

The Naming Conventions for Environment Variables documentation says:

Note: GitHub reserves the GITHUB_ environment variable prefix for internal use by GitHub. Setting an environment variable or secret with the GITHUB_ prefix will result in an error.

However, the example in jobs.<job_id>.steps[*].env sets a GITHUB_TOKEN environment variable. Which is correct?

[welcome]

Thanks for opening this issue. A GitHub docs team member should be by to give feedback soon. In the meantime, please check out the contributing guidelines.

[janiceilene]

Thanks for opening an issue @nex3! I'll triage this for the team to take a look 👀

[hubwriter]

Hi @nex3 - Many thanks for raising this issue. 👍

Both of the pages you refer to are correct. The GITHUB_ name is reserved for use by GitHub. One such use is the GITHUB_TOKEN secret that allows you to reference an automatically created GitHub App installation access token in an Actions workflow, as shown in the example on the second page you refer to.

For more information about GITHUB_TOKEN see: https://docs.github.com/en/actions/reference/authentication-in-a-workflow

I'm going to close this issue, but thanks for checking this with us and, of course, if you'd like to discuss this more please get back to us.

EDIT: I was wrong about this. See my comment, with suggested changes, below: #2693 (comment)

[nex3]

@hubwriter The issue is that the example in jobs.<job_id>.steps[*].env doesn't just reference the GITHUB_TOKEN secret, it actually sets an environment variable named GITHUB_TOKEN to the value of that secret, which is forbidden according to the environment variable docs.