Explicitly overwrite github tokens

.github/workflows/ci.yml

@@ -25,6 +25,9 @@ jobs:
 
       - name: Flake check
         run: nix flake check
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''
 
   deploy:
     runs-on: ubuntu-latest
@@ -52,3 +55,6 @@ jobs:
 
       - name: Deploy
         run: nix develop --command deploy
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''

.github/workflows/update.yml

@@ -23,6 +23,9 @@ jobs:
             access-tokens = github.com=${{ secrets.AUTOUPDATE_TOKEN }}
       - name: Update flake.lock
         uses: DeterminateSystems/update-flake-lock@v20
+        env:
+          ACTION_RUNTIME_TOKEN: ''
+          GITHUB_TOKEN: ''
         with:
           pr-title: "update flake inputs"
           pr-labels: |