The documentation states "The called workflow is automatically granted access to `github.token` and `secrets.GITHUB_TOKEN`."