use github secret instead of hardcoded