Addresses the security concern where secrets were directly interpolated
in GitHub Actions run commands across multiple workflows.
Following [GitHub's security best
practices](https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable),
secrets are now passed through intermediate environment variables
(matching the secret names: `PULUMI_STAGING_PASSPHRASE` and
`PULUMI_PROD_PASSPHRASE`) before being written to files.
## Changes
**deploy.yml:**
- Fixed staging deployment (line 92)
- Fixed production deployment (line 131)
**cancel-pulumi-lock.yml:**
- Fixed staging lock cancellation (line 62)
- Fixed production lock cancellation (line 70)
## Benefits
This approach:
- Fixes the security issue with direct secret interpolation in 4
locations
- Maintains compatibility with existing local development workflows
- Keeps the Makefile unchanged
- Uses environment variable names that match the secret names for
clarity
The key improvement is that `${{ secrets.X }}` is no longer expanded
directly in the run commands, reducing the risk of accidental disclosure
if GitHub's masking fails or is bypassed.
<!-- Provide a brief summary of your changes -->
## Motivation and Context
<!-- Why is this change needed? What problem does it solve? -->
The following PR adds an easy way to cancel stuck pulumi jobs (could be
temporary).
## How Has This Been Tested?
<!-- Have you tested this in a real application? Which scenarios were
tested? -->
## Breaking Changes
<!-- Will users need to update their code or configurations? -->
## Types of changes
<!-- What types of changes does your code introduce? Put an `x` in all
the boxes that apply: -->
- [ ] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] Documentation update
## Checklist
<!-- Go over all the following points, and put an `x` in all the boxes
that apply. -->
- [ ] I have read the [MCP
Documentation](https://modelcontextprotocol.io)
- [ ] My code follows the repository's style guidelines
- [ ] New and existing tests pass locally
- [ ] I have added appropriate error handling
- [ ] I have added or updated documentation as needed
## Additional context
<!-- Add any other context, implementation notes, or design decisions
-->
Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>
