Secure tokens so they cannot be printed to Actions console output by any user with access to run GH Actions.

[chrisba11]

As a security engineer, I want to restrict the use of secret access tokens to workflows running on the main branch in order to ensure that this project is not vulnerable to exposing those secrets in the GH Actions workflows run by contributors.

Technical Notes

Currently, any user who has the permission to run a GH Action has the ability to echo out the personal access tokens or GH App tokens we are using for publishing. We should be able to resolve this by moving all jobs that require use of these tokens to a standalone workflow that can only be triggered by push to the main branch. I believe we will have to move any related secrets to a protected environment that can only be accessed from the main branch as well.

Acceptance Criteria

1. Developers on a feature branch cannot push code that has access to the actions-helper GH app token.

[chrisba11]

Once this is merged in and functionality is confirmed, we will need to delete the org secret called ACTIONHELPER.