JASP's Tools/CMake/Config.cmake uses GITHUB_PAT as the default token compiled
into the application (Desktop/gui/githubpat.h) whenever GITHUB_PAT_DEF is
empty. The build container receives GITHUB_PAT from the start, so the build
token was compiled into bin/JASP and shipped in the published tarballs.
The token is now removed from the environment until the R module build, the
only step that needs it, GITHUB_PAT_DEF is pinned empty, and staging fails if
the token, or anything shaped like a GitHub token, is found in the package.
Claude-Session: https://claude.ai/code/session_01GGe7kUhooMFuzY6GaDb2w9
agw
4b6797f6f2