mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-19 10:22:17 +00:00
rcourtman
adb0f483bf
Five steps in the release-asset validation workflow built curl
commands like:
curl -H "Authorization: token ${{ secrets.GITHUB_TOKEN }}" ...
That renders the token into the step's shell command line, where it
is visible to any process able to read /proc on the runner during
the curl call. Convert all nine such call sites to pass the token
via env: GH_TOKEN and reference $GH_TOKEN in the header instead, so
the token only lives in the step env, never on argv.
No behavior change; the token value is identical.