Fine-grained personal access tokens for GitHub
It looks like you HAVE to set an expiry on this new shape of token?That's frustrating (though you can at least set it to an arbitrary far future date - though apparently limited to a year).I tend to use this kind of token for automations - where I have code running outside of GitHub that needs access to something.I very rarely want to limit that by time. Having to remember to rotate the access token every X months is annoying.I care much more about audit logs and the ability to easily revoke a token.Is there an argument for why non-expiring tokens are a bad idea that I'm missing here?