In a GitHub Actions workflow, the publish token is stored in encrypted form in the repository secrets and is injected into environment variables only when the workflow runs, to avoid leakage.