feat: allow configuring the token used for pre-activation reactions

[swimmesberger]

Problem

When using a GitHub App for authentication (via the github-app: frontmatter config, formerly app:), all agent tool calls correctly use the App token and appear as the custom bot (e.g. C.I.D.E.R[bot]). However, the 👀 eyes reaction added in pre_activation is hardcoded to use secrets.GITHUB_TOKEN in compiler_pre_activation_job.go:

// Explicitly use the GitHub Actions token (GITHUB_TOKEN) for reactions
// This ensures proper authentication for adding reactions
steps = append(steps, "          github-token: ${{ secrets.GITHUB_TOKEN }}\n")

This means even when a GitHub App is fully configured and working, the reaction always appears as github-actions[bot] — breaking the user experience of having a consistent bot identity across all workflow interactions.

Proposed Solution

Allow the reaction token to be overridden via frontmatter, falling back to GITHUB_TOKEN for backwards compatibility. For example:

tools:
  github:
    github-app:
      app-id: ${{ vars.APP_ID }}
      private-key: ${{ secrets.APP_PRIVATE_KEY }}

# Option A: dedicated reaction-token field
reaction-token: ${{ steps.github-mcp-app-token.outputs.token }}

# Option B: automatically reuse the configured github-app token for reactions too

Alternatively, automatically using the configured github-app: token for the reaction step (when present) would solve this with zero additional configuration.

Context

• Our repo uses a GitHub App as the identity for all agentic workflow interactions
• The agent's actual output comments appear as the custom bot ✅
• But the 👀 acknowledgement reaction on the triggering comment always shows github-actions[bot] ❌
• The jobs.pre-activation custom steps feature cannot work around this because it appends steps — it cannot replace or modify the built-in reaction step

Workaround

Currently none — the only option is to set reaction: none to suppress the reaction entirely, losing the instant-feedback UX.

---

Note: github-app: is the correct key as of v0.52.0 (renamed from app: in older versions).

[pelikhan]

Started #19427