This has been fixed via #1243. Thank you for the PR

@thomasrockhu-codecov this should've been accepted instead. The token is what's documented and been used earlier. Also, using multiple configuration mechanisms (inputs + env vars) is poor UX. It's going to generate a lot of unnecessary changes in workflows because many already set the input correctly. Using action inputs is a traditional way of passing arguments in the GHA ecosystem. Env vars may be used sometimes but it's not as straigthforward to remember which ones need to be env vars and which ones are regular vars

@webknjaz that's a fair point. However, we have other users who prefer to have it separated out in order to remember that is it a secret token. I have made a PR that updates the README with both versions with slight preference to using it under with:

@thomasrockhu-codecov the value literally says "secret" in the reference, in both cases. Neither "input", nor "with", nor "env" suggest secrets on their own.

@webknjaz I'm not sure what you're asking for now

@thomasrockhu-codecov I just pointed out that your statement does not sound consistent with the perception of the env vars.