Generating long-lived OAuth token for GitHub Actions pipeline

Running our Rust CI job against /oauth/token keeps dropping a 401 after the first hour. The pipeline needs a token that survives without manual re-auth. I’ve swapped the grant type to client_credentials using the app secret, but it’s just throwing invalid_grant. Here’s the payload we’re testing:

{"grant_type": "client_credentials", "client_id": "abc", "client_secret": "xyz"}

The WebSocket client hangs on handshake when the bearer expires mid-run. Docs mention a refresh flow but the reqwest client keeps timing out on the second call.