Since it looks like this example is using the built-in permissions model for the runner identity, I think this example should be github.token vs secrets.GITHUB_TOKEN. Since the latter implies the user must set up a secret beforehand with a personal access token.