From db071953c0474b774adc70ab59cc09a251ac05da Mon Sep 17 00:00:00 2001
From: Bryan Helmkamp <bryan@brynary.com>
Date: Fri, 24 Apr 2026 15:08:34 -0400
Subject: [PATCH] ci: isolate nightly release test credentials

---
 .github/workflows/nightly.yml | 7 +++----
 bin/dev/release.sh            | 7 +++++--
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index abc74c0e5..380917a70 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -60,12 +60,11 @@ jobs:
 
       - name: Release nightly
         if: steps.skip.outputs.skip != 'true'
-        env:
-          GH_TOKEN: ${{ steps.app-token.outputs.token }}
-          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
         run: |
           git config user.name "fabro-releases[bot]"
           git config user.email "fabro-releases[bot]@users.noreply.github.com"
+          release_token='${{ steps.app-token.outputs.token }}'
           git remote set-url origin \
-            "https://x-access-token:${GH_TOKEN}@github.com/${GITHUB_REPOSITORY}.git"
+            "https://x-access-token:${release_token}@github.com/${GITHUB_REPOSITORY}.git"
+          unset release_token
           bin/dev/release.sh nightly
diff --git a/bin/dev/release.sh b/bin/dev/release.sh
index d89554d49..b58f90b8f 100755
--- a/bin/dev/release.sh
+++ b/bin/dev/release.sh
@@ -116,12 +116,15 @@ verify_release_tests() {
   fi
 
   echo "Running release-mode test smoke (SEGMENT_WRITE_KEY baked in)..."
-  SEGMENT_WRITE_KEY="fake-for-local-smoke" \
-    cargo nextest run \
+  (
+    unset GH_TOKEN GITHUB_TOKEN
+    SEGMENT_WRITE_KEY="fake-for-local-smoke" \
+      cargo nextest run \
       --workspace \
       --release \
       --profile ci \
       --status-level slow
+  )
 }
 
 main() {