That should work when you add it to the build step. Alternatively, check in the .env file, as far as I know cra picks it up automatically.

- name: Build page
      run: npm run build
      env:
          REACT_APP_TOKEN: ${{ secrets.REACT_APP_TOKEN }}