GitHub Codespaces token validity after repository permission revocation

GitHub Codespaces utilizes short-lived tokens to provide seamless authentication to the GitHub API, adhering to the principle of least privilege by scoping permissions to the specific repository. These tokens are designed to expire upon session termination or codespace deletion.

There is uncertainty regarding the propagation delay when a user's repository permissions are revoked while a codespace session remains active. It is unclear if the active GITHUB_TOKEN is invalidated immediately upon the permission change or if it remains valid until the token's natural expiration or the session's end.

• Does the GITHUB_TOKEN reflect permission changes in real-time?
• What is the expected synchronization lag between identity provider permission updates and the active container's token validity?