ex: MongoClient(username: mongodb_pass) instead of having the password in plain sight in the script.

Not having the credentials directly in the script is good practice, yes. That has nothing to do with masking, though.

You can use environment variable just like in the Actions workflow, you’ll just have to set them when you run the script. Just be aware of what else you run in the same environment and of shell history (if you use Bash, HISTCONTROL is your friend).

An alternative is to use a config file, just read the values from another file instead of coding them into the script. Python has built-in parsers for JSON and INI-style files. I like YAML, but that requires installing PyYAML. Obviously don’t commit that file, I recommend adding it to .gitignore.

You can even support both in your script: Read environment variables or config file depending on command line options or simply what’s available.

            - name: start bot
              env:
                TOKEN: ${{ secrets.SECRET }}

In the GitHub Action you named the variable secrets.SECRET but in environment variables you named it TOKEN. Either change the name of the environment variable to SECRET:

            - name: start bot
              env:
                SECRET: ${{ secrets.SECRET }}

or change your code:

    SECRET = os.environ['TOKEN']

There are three types of secrets within GitHub Actions.

1. Organization secrets
2. Repository secrets
3. Environment secrets

To access Environment secrets, you have to referencing an environment in your job. (Thanks to @riQQ)

name: python

on: push

jobs:
  test_env:
    environment: TEST_SECRET
    runs-on: ubuntu-latest
    steps:
    - name: Set up Python
      uses: actions/setup-python@v2
      with:
        python-version: 3.8
        
    - name: Test env vars for python
      run: python -c 'import os;print(os.environ)'
      env:
        ENV_SECRET: ${{ secrets.ENV_SECRET }} 
        REPO_SECRET: ${{ secrets.REPO_SECRET }} 

# project/.gitignore

passwords.py

# project/passwords.py

GITHUB_KEY = '123'
GITHUB_KEY_SECRET = 'ABC'
GITHUB_TOKEN = '456'
GITHUB_TOKEN_SECRET = 'XYZ'

# project/my_script.py

from passwords import GITHUB_KEY, GITHUB_KEY_SECRET, GITHUB_TOKEN, GITHUB_TOKEN_SECRET

KEY = GITHUB_KEY
KEY_SECRET = GITHUB_KEY_SECRET
TOKEN = GITHUB_TOKEN
TOKEN_SECRET = GITHUB_TOKEN_SECRET

Something along the following, with the database password stored as GitHub secret with name SCRIPT_CREDENTIALS:

steps:
  - name: Execute script
    env:
      PASSWORD: ${{ secrets.SCRIPT_CREDENTIALS }}
    run: php script.php

script.php:

$conn = new mysqli($servername, $username, $password);

if ($conn->connect_error) {

die("Connection failed: " . $conn->connect_error);

}

echo "Connected successfully";

?>

PHP: getenv - Manual

As this post was originally hidden by I assume spam protection I have found solution.
My tox.ini lacked definition of which env variables should be passed to the tests, tox does not pass all the variables.
So I have extended [testenv] definition with

passenv =
    KIWI_API_KEY

which solved the issue.