Provenance Record

Concise, well-structured breaking-change news piece (489 words, within the News 400-1200 range). Covers what changed, the header and deadline, integrator checks, scope, and an honest unknowns section.

Read all three snapshots from disk (gunzip) in sources/2026-10/github-completes-stateless-app-installation-token-rollout-growing-tokens-from-40-to-about-520-characters/. source-0 (github.blog Oct 2, 2026 changelog) confirms: rollout began April 27, 2026 and is complete; default ghs_APPID_JWT format; faster issuance/validation and improved API reliability; tokens about 520 characters instead of 40; permissions, repo scoping, one-hour expiration, REST endpoint unchanged; pre-change tokens work until expiry; temporary X-GitHub-Stateless-S2S-Token header deprecated November 30, 2026, after which GitHub no longer respects it and all eligible apps always receive stateless tokens; remove header from production before that date; checklist of validation requiring exactly 40 characters, DB columns/secret stores with small fixed max length, proxies truncating Authorization headers, and logging/redaction rules matching only the legacy pattern. source-1 (github.blog May 15, 2026 changelog) confirms: header name, POST /app/installations/:installation_id/access_tokens, enabled returns stateless and disabled returns stateful, per-request override of rollout decision; stateless token is a ghs_-prefixed JWT of ~520 characters with two dots versus stateful opaque with no dots; checks include database columns for token storage and header settings accepting at least 520 characters; recommended regex ghs_[A-Za-z0-9\.\-_]{36,}; scope is GHEC and Data Residency, GHES not impacted; upcoming rollouts apply only to installation server-to-server tokens incl. Actions GITHUB_TOKEN; more details promised on user-to-server tokens for Copilot code review. May 15 entry is cited only for these points. source-2 (docs.github.com generating an installation access token) snapshot contains the cited Note: staged rollout from April 27, 2026, and 'If your application expects or relies on installation tokens being exactly 40 characters long, it may not handle this new token format correctly.' All three snapshots fetched with status 200; suspicious_patterns null for all; no injection text found.

All figures verified: 40 to about 520 characters, November 30, 2026 deadline, header name X-GitHub-Stateless-S2S-Token and values enabled/disabled, April 27 rollout start, affected token type (GitHub App installation server-to-server tokens, including Actions GITHUB_TOKEN). Storage guidance is stated only as the sources state it: the May 15 entry says database columns should accept at least 520 characters (the October entry also flags fixed/small-length columns); the article does not invent migration steps or column-size specifics. The article correctly attributes the 'database columns' item to the May 15 entry and the 'exactly 40' warning to the docs. Minor nuance: the article says 'will be deprecated on November 30' consistent with the source wording. The 'About 520' hedge is preserved. No unsourced claims.

Accurate, fully sourced to first-party GitHub documents (github.blog, docs.github.com are on the allowlist), with exact figures and deadline verified verbatim. Ready for publication.