Security question about ACTIONS_RUNTIME_TOKEN

Background

I am working on an application that makes use of https://github.com/actions/toolkit/tree/main/packages/cache to cache GitHub Action output artifacts.

The @actions/cache library needs access to 2 environment variables in order to write to the cache HTTP service: ACTIONS_CACHE_URL and ACTIONS_RUNTIME_TOKEN. These environment variables are automatically available to re-usable action main scripts, but not to standard workflow steps. However, this application needs to run in standard workflow run steps, so it cannot access these variables by default.

So, my current solution is to first run an action that simply re-exports these 2 environment variables to subsequent workflow steps by writing them to the $GITHUB_ENV file.

Question

The above workaround works great, however I am concerned about the security implications of making the ACTIONS_RUNTIME_TOKEN environment variable more widely available (previously just re-usable actions, now to all workflow steps).

What power does ACTIONS_RUNTIME_TOKEN grant? Does it include any powers beyond the ability to upload cache artifacts?

Is this token valid after the workflow ends? Could the token be re-used outside of the particular workflow run that it was created for?

I can see that it is a JWT with the following structure, and the scp field seems to give some hint about what the powers might be:

{
  nameid: 'dddddddd-dddd-dddd-dddd-dddddddddddd',
  scp: 'Actions.GenericRead:00000000-0000-0000-0000-000000000000 Actions.UploadArtifacts:00000000-0000-0000-0000-000000000000/1:Build/Build/12 LocationService.Connect ReadAndUpdateBuildByUri:00000000-0000-0000-0000-000000000000/1:Build/Build/12',
  IdentityTypeClaim: 'System:ServiceIdentity',
  'http://schemas.xmlsoap.org/ws/2005/05/identity/claims/sid': 'DDDDDDDD-DDDD-DDDD-DDDD-DDDDDDDDDDDD',
  'http://schemas.microsoft.com/ws/2008/06/identity/claims/primarysid': 'dddddddd-dddd-dddd-dddd-dddddddddddd',
  aui: 'REDACTED',
  sid: 'REDACTED',
  ac: '[{"Scope":"refs/heads/master","Permission":3}]',
  acsl: '10',
  orchid: 'REDACTED.tests.__default',
  iss: 'vstoken.actions.githubusercontent.com',
  aud: 'vstoken.actions.githubusercontent.com|vso:REDACTED',
  nbf: 1649863186,
  exp: 1649864686
}

Thanks for any information!

(Also sorry, I realize this is not a bug, but I cannot remove the label)

Start with the @actions/cache package and the ACTIONS_CACHE_URL and ACTIONS_RUNTIME_TOKEN entry points described in the issue. Compare their availability in reusable action main scripts and standard workflow run steps, then document the token's permissions and expiration behavior. Done means the security implications and reuse limits are clearly answered.