What this pipeline needs
When you connected Git Sync, Grafana got credentials to read your Git repository (for example a personal access token or another auth method). The CI workflow only regenerates JSON and checks that the repo files match. It does not call the Grafana API to deploy.
For that generate-and-check pattern you often need no Grafana secret in GitHub Actions. GitHub provides GITHUB_TOKEN automatically for checkout and related steps.
When you would add Grafana credentials
Add a Grafana token to repository secrets only if your pipeline also talks to Grafana (for example a separate gcx or API step). That is outside this journey’s happy path. Keep secrets in Settings > Secrets and variables > Actions, and never commit tokens to the repository.
Keep Git Sync auth in Grafana
Do not move your Git Sync repository credentials into the Actions workflow unless you have a specific reason. Git Sync authentication stays in Grafana under Administration > General > Provisioning.