Update README.md

[amitie10g]

Passing secret to env may potentially leak the token on the logs. Using it directly into the command line will ofuscate it.

[imjasonh]

I'm not sure there's a difference either way.

With this workflow:

on:
  workflow_dispatch:

jobs:
  test:
    name: test secret obfuscation
    runs-on: ubuntu-latest

    steps:
    - run: echo ${{secrets.TEST}}
    
    - env:
        TEST: ${{secrets.TEST}}
      run: echo ${TEST}

More docs about this here: https://docs.github.com/en/actions/security-for-github-actions/security-guides/using-secrets-in-github-actions#accessing-your-secrets

edit: workflows can also tell GitHub that a value is sensitive: https://docs.github.com/en/actions/writing-workflows/choosing-what-your-workflow-does/workflow-commands-for-github-actions#masking-a-value-in-a-log