Remove token file step, inline credential helper in gh api call

Co-authored-by: Ona <no-reply@ona.com>

Author: meysholdt

.ona/fix-codescan-alert.yaml

@@ -17,14 +17,11 @@ action:
           command -v gh && exit 0
           curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
           sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
-    # Step 2: Export GITHUB_TOKEN from git credential helper
+    # Step 2: Fetch the highest-severity open code scanning alert
     - task:
         command: |
-          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' > /tmp/.gh-token
-    # Step 3: Fetch the highest-severity open code scanning alert
-    - task:
-        command: |
-          GITHUB_TOKEN=$(cat /tmp/.gh-token) gh api repos/{owner}/{repo}/code-scanning/alerts \
+          export GITHUB_TOKEN=$(printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}')
+          gh api repos/{owner}/{repo}/code-scanning/alerts \
             --jq '[.[] | select(.state=="open")] | sort_by(.rule.security_severity_level // "low") | reverse | .[0]' \
             > /tmp/codescan-alert.json
           cat /tmp/codescan-alert.json

.ona/fix-dependabot-alert.yaml

@@ -17,14 +17,11 @@ action:
           command -v gh && exit 0
           curl -sL https://github.com/cli/cli/releases/latest/download/gh_2.74.0_linux_amd64.tar.gz | tar xz -C /tmp
           sudo mv /tmp/gh_2.74.0_linux_amd64/bin/gh /usr/local/bin/gh
-    # Step 2: Export GITHUB_TOKEN from git credential helper
+    # Step 2: Fetch the highest-severity open Dependabot alert
     - task:
         command: |
-          printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}' > /tmp/.gh-token
-    # Step 3: Fetch the highest-severity open Dependabot alert
-    - task:
-        command: |
-          GITHUB_TOKEN=$(cat /tmp/.gh-token) gh api repos/{owner}/{repo}/dependabot/alerts \
+          export GITHUB_TOKEN=$(printf 'protocol=https\nhost=github.com\n\n' | git credential fill | awk -F= '/password/{print $2}')
+          gh api repos/{owner}/{repo}/dependabot/alerts \
             --jq '[.[] | select(.state=="open")] | sort_by(.security_advisory.cvss.score) | reverse | .[0]' \
             > /tmp/dependabot-alert.json
           cat /tmp/dependabot-alert.json