andrew 8086a0099c package workflow: read AWS config from secrets, not variables ... On a public repo, Actions variables are not masked in workflow logs. The AWS role ARN and artifact bucket name embed the AWS account ID — not catastrophic, but norm-preserving to keep them out of public logs. Switch all four values (region, role, project, bucket) from `${{ vars.* }}` to `${{ secrets.* }}`. When secrets are passed via `with:` to a reusable workflow, GitHub's masking still applies because the value is added to the run's mask list as soon as the secret reference is resolved. Followup to #33 — should have landed as secrets from the start.		2026-04-18 21:43:12 +03:00
..
workflows	package workflow: read AWS config from secrets, not variables	2026-04-18 21:43:12 +03:00