As seen here in this blog post you can specify a secret token in the environment and use Sys.getenv() to get the value of that token from the environment.

      - name: example
        env:
          SECRET_TOKEN: ${{ secrets.SECRET_TOKEN }}
        run: |
          secret_token = Sys.getenv("SECRET_TOKEN")