Use env-based guards for pinned smoke secrets

Author: a-a-k

.github/workflows/ci.yml

@@ -14,6 +14,9 @@ on:
 jobs:
   validate:
     runs-on: ubuntu-latest
+    env:
+      MB3R_GHCR_USERNAME: ${{ secrets.MB3R_GHCR_USERNAME }}
+      MB3R_GHCR_TOKEN: ${{ secrets.MB3R_GHCR_TOKEN }}
     steps:
       - uses: actions/checkout@v4
 
@@ -35,14 +38,11 @@ jobs:
         run: make e2e-adapters
 
       - name: Generic live smoke with pinned GHCR images
-        if: ${{ secrets.MB3R_GHCR_USERNAME != '' && secrets.MB3R_GHCR_TOKEN != '' }}
-        env:
-          MB3R_GHCR_USERNAME: ${{ secrets.MB3R_GHCR_USERNAME }}
-          MB3R_GHCR_TOKEN: ${{ secrets.MB3R_GHCR_TOKEN }}
+        if: ${{ env.MB3R_GHCR_USERNAME != '' && env.MB3R_GHCR_TOKEN != '' }}
         run: make k8s-smoke-generic-pinned
 
       - name: Note pinned GHCR smoke precondition
-        if: ${{ secrets.MB3R_GHCR_USERNAME == '' || secrets.MB3R_GHCR_TOKEN == '' }}
+        if: ${{ env.MB3R_GHCR_USERNAME == '' || env.MB3R_GHCR_TOKEN == '' }}
         run: |
           echo "::warning::Pinned GHCR smoke skipped because MB3R_GHCR_USERNAME and MB3R_GHCR_TOKEN are not configured."
           echo "::warning::Repo-scoped GITHUB_TOKEN does not currently prove cross-repo pull access to upstream Bering/Sheaft GHCR packages."