syntaqxBrokered secrets keep working after a job's token is swapped. The runner Worker looks up a job's stand-ins (brokered_secrets) with the token the job started with, which a harness that asks for rotation spends on its first spec fetch. The swap now keeps that token's hash beside the new one (first_token_hash, migration 0020), and brokered_secrets alone accepts it; reporting, logs, artifacts, cache, job_auth, actions and the spec itself take only the current token, and no API route passes brokered_secrets on, so the kept token is reachable only through g1t's own service bindings. It is cleared when the job ends, is cancelled, is claimed again or is re-run. The self-hosted runners guide says which lookup still takes it.495a2cbHistory
README.md
GitHub's workflow schema
workflow-v1.0.json is GitHub's schema for workflow files, copied unchanged from
actions/languageservices, file
workflow-parser/src/workflow-v1.0.json, at commit
4043eda158e16579cc5fb1b0b07a4bce2a76f0b5 (5 August 2026). It is MIT licensed;
LICENSE is that repository's licence, copied from the same commit.
g1t does not read it at run time. src/syntax.rs lists the keys each part of a
workflow may have, and its tests check those lists against this file, so they
cannot drift from GitHub's. To update it, copy the file again, write the commit
here, and run cargo test -p g1t-actions.