CI/release: Do not pass the bunny AccessKey on the command line

Signed-off-by: Janne Grunau <[email protected]>

Author: jannau

.github/workflows/release.yaml

@@ -27,6 +27,7 @@ jobs:
         env:
           PKG_URL: "https://storage.bunnycdn.com/asahilinux/${{ inputs.upload-type }}"
           PKG_VER: "installer-${{ needs.build.outputs.installer_ver }}"
+          ACCESS_KEY: ${{ secrets.BUNNY_TOKEN }}
         run: |
           if [ ! -e "releases/${PKG_VER}" ]; then
               echo "Package not found!"
@@ -36,7 +37,8 @@ jobs:
           upload() {
                curl -# --fail --request PUT \
                    --url "${2}" \
-                   -H "AccessKey: ${{ secrets.BUNNY_TOKEN }}" \
+                   --variable %ACCESS_KEY \
+                   --expand-header 'AccessKey: {{ACCESS_KEY}}' \
                    -H "Content-Type: ${3}" \
                    -H "Accept: application/json" \
                    --data-binary @${1}