Workflow run logs currently render authentication configuration values supplied through environment variables. Move the non-mode configuration inputs to masked environment secrets so workflow behavior remains unchanged while reducing unnecessary metadata exposure.
The rollout mode should remain an environment variable so it can still be changed without editing workflow code. DevFlow jobs should also use the run-scoped GitHub Actions token with the dedicated Copilot request permission instead of requiring a separately managed user credential.
Workflow run logs currently render authentication configuration values supplied through environment variables. Move the non-mode configuration inputs to masked environment secrets so workflow behavior remains unchanged while reducing unnecessary metadata exposure.
The rollout mode should remain an environment variable so it can still be changed without editing workflow code. DevFlow jobs should also use the run-scoped GitHub Actions token with the dedicated Copilot request permission instead of requiring a separately managed user credential.