fix(ci): pass github.token via env mapping instead of direct run interpolation

[Copilot]

Directly interpolating ${{ github.token }} inside a run: block embeds the token as plain text in the shell script before execution, exposing it to log output, process listings, and shell injection if the value contains metacharacters.

Change

Move github.token out of the shell script body and into the step's env: mapping in the "Clone github/gh-aw-marketplace repository" step of ci.yml.

# Before — token literal in shell script
run: |
  AUTH_HEADER=$(printf 'x-access-token:%s' '${{ github.token }}' | base64 | tr -d '\n')

# After — token injected as env var
env:
  GH_TOKEN: ${{ github.token }}
run: |
  AUTH_HEADER=$(printf 'x-access-token:%s' "${GH_TOKEN}" | base64 | tr -d '\n')

Resolves RGS-008 (runner-guard static analysis finding, severity: High).

[Copilot]

Pull request overview

This PR updates the CI workflow to avoid embedding ${{ github.token }} directly inside a run: script by passing it via the step’s env: mapping, addressing a runner-guard finding (RGS-008).

Changes:

• Add env: GH_TOKEN: ${{ github.token }} to the “Clone github/gh-aw-marketplace repository” step.
• Update the shell script to reference ${GH_TOKEN} instead of inlining the expression.

Show a summary per file

File	Description
.github/workflows/ci.yml	Moves github.token usage out of the shell script body into env for the marketplace clone step.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 1