I agree with @jwswj I think this should use `BOXEN_GITHUB_PASSWORD` and reuse `BOXEN_GITHUB_LOGIN`.