Use GITHUB_TOKEN env var instead of gh auth login

Avoids read:org scope requirement. Token is extracted from git
credential helper, saved to /tmp/.gh-token, and passed inline.

Co-authored-by: Ona <no-reply@ona.com>

Author: meysholdt

.ona/fix-codescan-alert.yaml

@@ -17,14 +17,14 @@ action:
           command -v gh && exit 0
           curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
           sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
-    # Step 2: Authenticate gh using the git credential helper
+    # Step 2: Export GITHUB_TOKEN from git credential helper
     - task:
         command: |
-          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' | gh auth login --with-token
+          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' > /tmp/.gh-token
     # Step 3: Fetch the highest-severity open code scanning alert
     - task:
         command: |
-          gh api repos/{owner}/{repo}/code-scanning/alerts \
+          GITHUB_TOKEN=$(cat /tmp/.gh-token) gh api repos/{owner}/{repo}/code-scanning/alerts \
             --jq '[.[] | select(.state=="open")] | sort_by(.rule.security_severity_level // "low") | reverse | .[0]' \
             > /tmp/codescan-alert.json
           cat /tmp/codescan-alert.json

.ona/fix-dependabot-alert.yaml

@@ -17,14 +17,14 @@ action:
           command -v gh && exit 0
           curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
           sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
-    # Step 2: Authenticate gh using the git credential helper
+    # Step 2: Export GITHUB_TOKEN from git credential helper
     - task:
         command: |
-          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' | gh auth login --with-token
+          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' > /tmp/.gh-token
     # Step 3: Fetch the highest-severity open Dependabot alert
     - task:
         command: |
-          gh api repos/{owner}/{repo}/dependabot/alerts \
+          GITHUB_TOKEN=$(cat /tmp/.gh-token) gh api repos/{owner}/{repo}/dependabot/alerts \
             --jq '[.[] | select(.state=="open")] | sort_by(.security_advisory.cvss.score) | reverse | .[0]' \
             > /tmp/dependabot-alert.json
           cat /tmp/dependabot-alert.json