ci: isolate nightly release test credentials

.github/workflows/nightly.yml

@@ -60,12 +60,11 @@ jobs:
 
       - name: Release nightly
         if: steps.skip.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name "fabro-releases[bot]"
           git config user.email "fabro-releases[bot]@users.noreply.github.com"
+          release_token='${{ steps.app-token.outputs.token }}'
           git remote set-url origin \
-            "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+            "https://x-access-token:${release_token}@github.com/${GITHUB_REPOSITORY}.git"
+          unset release_token
           bin/dev/release.sh nightly

bin/dev/release.sh

@@ -116,12 +116,15 @@ verify_release_tests() {
   fi
 
   echo "Running release-mode test smoke (SEGMENT_WRITE_KEY baked in)..."
-  SEGMENT_WRITE_KEY="fake-for-local-smoke" \
-    cargo nextest run \
+  (
+    unset GH_TOKEN GITHUB_TOKEN
+    SEGMENT_WRITE_KEY="fake-for-local-smoke" \
+      cargo nextest run \
       --workspace \
       --release \
       --profile ci \
       --status-level slow
+  )
 }
 
 main() {