use org actions secret for grading

.forgejo/workflows/grade.yml

@@ -2,24 +2,23 @@ name: grade
 on: [push]
 
 # Production wiring (forgejo-runner on ghost):
-#   - forgejo-runner v13 config sets docker_host: automount (host socket into
-#     the job container), so docker_grade.sh drives the host daemon as designed
-#   - hidden tests mount from the runner host (/opt/grade-hidden) — never in
-#     this repo
-#   - GRADE_HMAC_SECRET mounts from /opt/grade/grade.env on the runner host
+#   - forgejo-runner v13: docker_host: automount -> the job container gets the
+#     host docker socket, so docker_grade.sh drives the host daemon as designed
+#   - hidden tests mount from the runner host via the nested docker run
+#     (-v /opt/grade-hidden/...) — never in this repo
+#   - GRADE_HMAC_SECRET is a Forgejo org/repo Actions secret (set via API),
+#     injected with ${{ secrets.GRADE_HMAC_SECRET }}
 jobs:
   grade:
     runs-on: docker
     container:
       image: gitea/runner-images:ubuntu-22.04
-      options: >-
-        -v /opt/grade/grade.env:/run/secrets/grade.env:ro
-        -v /opt/grade-hidden:/opt/grade-hidden:ro
     steps:
       - uses: actions/checkout@v4
       - name: Grade (blank fails, solved passes)
+        env:
+          GRADE_HMAC_SECRET: ${{ secrets.GRADE_HMAC_SECRET }}
         run: |
-          set -a; . /run/secrets/grade.env; set +a
           docker run --rm --network=none \
             -v "$PWD":/work \
             -v /opt/grade-hidden/cs2060/record-manager:/hidden:ro \