Addresses the security concern where secrets were directly interpolated
in GitHub Actions run commands across multiple workflows.
Following [GitHub's security best
practices](https://docs.github.com/en/actions/reference/security/secure-use#use-an-intermediate-environment-variable),
secrets are now passed through intermediate environment variables
(matching the secret names: `PULUMI_STAGING_PASSPHRASE` and
`PULUMI_PROD_PASSPHRASE`) before being written to files.
## Changes
**deploy.yml:**
- Fixed staging deployment (line 92)
- Fixed production deployment (line 131)
**cancel-pulumi-lock.yml:**
- Fixed staging lock cancellation (line 62)
- Fixed production lock cancellation (line 70)
## Benefits
This approach:
- Fixes the security issue with direct secret interpolation in 4
locations
- Maintains compatibility with existing local development workflows
- Keeps the Makefile unchanged
- Uses environment variable names that match the secret names for
clarity
The key improvement is that `${{ secrets.X }}` is no longer expanded
directly in the run commands, reducing the risk of accidental disclosure
if GitHub's masking fails or is bypassed.
6516f756f3