ci: use Buildkite secret for mise GitHub access

Author: lox

.buildkite/hooks/pre-command

@@ -12,14 +12,3 @@ mkdir -p \
 export GOCACHE="${cache_root}/go/build"
 export GOMODCACHE="${cache_root}/go/pkg/mod"
 export GOLANGCI_LINT_CACHE="${cache_root}/golangci-lint"
-
-# CI pins tool versions in mise.toml/mise.lock, but the go: backend used for
-# go-cover-treemap does not support locked-mode URLs. Skip the GitHub API-backed
-# attestation/SLSA checks instead so reruns do not fail on unauthenticated rate
-# limits inside the mise plugin.
-export MISE_AQUA_GITHUB_ATTESTATIONS=false
-export MISE_AQUA_SLSA=false
-export MISE_GITHUB_ATTESTATIONS=false
-export MISE_GITHUB_GITHUB_ATTESTATIONS=false
-export MISE_GITHUB_SLSA=false
-export MISE_SLSA=false

.buildkite/pipeline.release.yml

@@ -15,6 +15,7 @@ steps:
     artifact_paths:
       - dist/**/*
     secrets:
+      - MISE_GITHUB_TOKEN
       - POSTHOG_API_KEY
       - OAUTH_CLIENT_ID
     command: 'GOOS="{{matrix}}" .buildkite/release.sh release --clean --split'
@@ -39,6 +40,7 @@ steps:
     env:
       AWS_REGION: us-east-1
     secrets:
+      - MISE_GITHUB_TOKEN
       - POSTHOG_API_KEY
       - OAUTH_CLIENT_ID
     plugins:

.buildkite/pipeline.yml

@@ -9,13 +9,17 @@ cache: ".buildkite/cache-volume"
 steps:
   - name: ":golangci-lint: lint"
     command: 'golangci-lint run --verbose --timeout 3m'
+    secrets:
+      - MISE_GITHUB_TOKEN
     plugins:
       - *mise_plugin
 
   - name: ":go: test"
     key: test
     artifact_paths:
       - cover-tree.svg
+    secrets:
+      - MISE_GITHUB_TOKEN
     commands:
       # Hosted agents inject org/token env that breaks config-precedence tests,
       # so clear those variables in the command shell right before go test.
@@ -38,6 +42,7 @@ steps:
     artifact_paths:
       - dist/**/*
     secrets:
+      - MISE_GITHUB_TOKEN
       - POSTHOG_API_KEY
       - OAUTH_CLIENT_ID
     command: 'GOOS="{{matrix}}" .buildkite/release.sh release --clean --snapshot --split'