explicitly set github client secret in env