fix(action): remove ${{ secrets.* }} from input description — real cause of the load failure (line 9, not 11)

[Larslllllll]

Fixes #3.

Root cause is line 9, not line 11

The issue (and the follow-up comment) both point at the default: on line 11. That line is fine —
${{ github.token }} is a valid expression in action metadata and is already what the repo ships.

The actual culprit is the description on line 9:

github-token:
  description: 'Token used to read comments and post replies/labels. Usually ${{ secrets.GITHUB_TOKEN }}.'

GitHub evaluates ${{ }} expressions in action.yml metadata including inside description
strings. The secrets context does not exist there, so the file is rejected before any step runs.

The reported error locates it exactly:

(Line: 9, Col: 18): Unrecognized named-value: 'secrets'.
Located at position 1 within expression: secrets.GITHUB_TOKEN

Line 9 is the description; column 18 is the first character of its value. I verified this against the
file directly — line 9 col 18 is 'Token used to read comments..., and ${{ appears on exactly two
lines, 9 and 11. Line 11 uses the github context and is valid, which is why removing the default (the
suggested fix in the issue) would not have resolved the failure.

Both main and the v0 tag carry the identical file, so every consumer of profullstack/coinpaybot@v0
is affected — matching the reports from malware-test-prs.

Fix

Rewrite the description as plain prose so nothing is parsed as an expression:

description: 'Token used to read comments and post replies/labels. Pass secrets.GITHUB_TOKEN from your workflow.'

The guidance is preserved, just not as a template. default: ${{ github.token }} is left untouched,
and examples/coinpay-invoice.yml continues to pass github-token: ${{ secrets.GITHUB_TOKEN }} —
valid there, because workflow files do expose the secrets context.

Scope and release note

One line, metadata only. No source, dist, or behaviour change.

Note: v0 currently points at 6da69f8 while main is at 71b41a4. Once this merges the v0 tag
needs to be moved for consumers to pick the fix up, otherwise @v0 will keep failing.

[ralyodio]

Superseded by #4, which landed the same fix on the same line (action.yml:9). main no longer evaluates any secrets.* expression in an input description — verified on the merged tree. Thanks for the second look; the two PRs were the same change with different wording, so only one could land.