[SECURITY] Don't place repo_token inside the coveralls.json file

[mdedetrich]

We are using sbt-coveralls for an open source company project and I just got notified from our security team that the repo_token field inside of the coveralls.json file constitutes a security risk, especially when combined with sbt-github-actions since it will place the coveralls.json file inside of an archive that gets cached.

Is it possible to remove this field entirely?

[rolandtritsch]

Hi @mdedetrich. I am trying to reproduce this ...

I am using sbt-coveralls-example.

The github-actions ci pipeline is using secrets. I am not sure what coveralls.json file you are referring to.