[guitarrapc]

detected via seiton

.github/workflows/build-natives.yaml
  .github/workflows/build-natives.yaml:515:60: error [run-secrets-context-direct-use] run script must not reference ${{ secrets.* }} directly; map secrets to env and use shell variables instead (e.g. ${TOKEN}, $TOKEN, or $env:TOKEN)
Error: Process completed with exit code 1.

[Copilot]

Copilot review overview

🟢 Approval recommended

The focused workflow change correctly resolves the reported secret-context violation without altering behavior.

Review effort: Balanced
Findings: None

What changed in this PR

Moves the GitHub token from direct script interpolation into a step environment variable, satisfying the workflow security check.

Changes:

• Maps secrets.GITHUB_TOKEN to env.GITHUB_TOKEN.
• Uses the shell variable when configuring the authenticated Git remote.

File	Description
.github/​workflows/​build-natives.yaml	Safely exposes the token to the Git command through the environment.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.