Obtain job-level token by default for less privileged runs (#198)

entry

@@ -19732,7 +19732,7 @@ var require_core = __commonJS({
       process.env["PATH"] = `${inputPath}${path4.delimiter}${process.env["PATH"]}`;
     }
     exports.addPath = addPath;
-    function getInput2(name, options) {
+    function getInput3(name, options) {
       const val = process.env[`INPUT_${name.replace(/ /g, "_").toUpperCase()}`] || "";
       if (options && options.required && !val) {
         throw new Error(`Input required and not supplied: ${name}`);
@@ -19742,9 +19742,9 @@ var require_core = __commonJS({
       }
       return val.trim();
     }
-    exports.getInput = getInput2;
+    exports.getInput = getInput3;
     function getMultilineInput(name, options) {
-      const inputs = getInput2(name, options).split("\n").filter((x) => x !== "");
+      const inputs = getInput3(name, options).split("\n").filter((x) => x !== "");
       if (options && options.trimWhitespace === false) {
         return inputs;
       }
@@ -19754,7 +19754,7 @@ var require_core = __commonJS({
     function getBooleanInput(name, options) {
       const trueValue = ["true", "True", "TRUE"];
       const falseValue = ["false", "False", "FALSE"];
-      const val = getInput2(name, options);
+      const val = getInput3(name, options);
       if (trueValue.includes(val))
         return true;
       if (falseValue.includes(val))
@@ -141999,29 +141999,40 @@ function AwaitDependencyInstallationTool(ctx) {
 var core3 = __toESM(require_core(), 1);
 import assert2 from "node:assert/strict";
 var githubInstallationToken;
+function setEnvironmentVariable(name, value2) {
+  const hadValue = Object.hasOwn(process.env, name);
+  const originalValue = process.env[name];
+  if (typeof value2 === "string") {
+    process.env[name] = value2;
+  } else {
+    delete process.env[name];
+  }
+  return () => {
+    if (hadValue) {
+      process.env[name] = originalValue;
+    } else {
+      delete process.env[name];
+    }
+  };
+}
 async function resolveInstallationToken() {
   assert2(!githubInstallationToken, "GitHub installation token is already set.");
-  const originalToken = process.env.GITHUB_TOKEN;
-  if (originalToken) {
-    process.env.ORIGINAL_GITHUB_TOKEN = originalToken;
-  }
+  const githubJobToken = core3.getInput("token");
   const externalToken = process.env.GH_TOKEN;
   const token = externalToken || await acquireNewToken();
-  process.env.GITHUB_TOKEN = token;
+  const revertGithubToken = setEnvironmentVariable("GITHUB_TOKEN", token);
   githubInstallationToken = token;
   if (isGitHubActions) {
     core3.setSecret(token);
   }
   return {
     token,
-    originalToken,
+    // in GitHub Actions environment this fallback token should always come from the action's input
+    // but in other environments there is no secondary token like this so we just use the installation token itself
+    githubJobToken,
     async [Symbol.asyncDispose]() {
       githubInstallationToken = void 0;
-      if (originalToken) {
-        process.env.GITHUB_TOKEN = originalToken;
-      } else {
-        delete process.env.GITHUB_TOKEN;
-      }
+      revertGithubToken();
       if (externalToken) {
         return;
       }
@@ -162542,7 +162553,11 @@ async function setupGit(params) {
   } catch {
     log.debug("\xBB no existing authentication headers to remove");
   }
-  const originToken = params.bashPermission === "enabled" ? params.token : params.originalToken || params.token;
+  const originToken = params.bashPermission === "enabled" ? params.token : (
+    // in GitHub Actions environment this less-capable job token should always be available in the action's input
+    // but in other environments there is no secondary token like this so we just use the installation token itself
+    params.githubJobToken || params.token
+  );
   if (params.event.is_pr !== true || !params.event.issue_number) {
     const originUrl2 = `https://x-access-token:${originToken}@github.com/${params.owner}/${params.name}.git`;
     $("git", ["remote", "set-url", "origin", originUrl2], { cwd: repoDir });
@@ -162651,7 +162666,6 @@ async function main() {
     normalizeEnv();
     const timer = new Timer();
     const tokenRef = __using(_stack2, await resolveInstallationToken(), true);
-    process.env.GITHUB_TOKEN = tokenRef.token;
     const octokit = createOctokit(tokenRef.token);
     const runInfo = await resolveRun({ octokit });
     const toolState = initToolState({ runInfo });
@@ -162686,7 +162700,7 @@ async function main() {
         });
         await setupGit({
           token: tokenRef.token,
-          originalToken: tokenRef.originalToken,
+          githubJobToken: tokenRef.githubJobToken,
           bashPermission: payload.bash,
           owner: runContext.repo.owner,
           name: runContext.repo.name,