Scope gh-aw workflow secrets to GITHUB_TOKEN

[jonathanpeppers]

Adds explicit github-token entries under tools.github and safe-outputs in .github/workflows/java-interop-reviewer.md so the compiled lock file no longer references the gh-aw fallback secret names GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN.

Why

A secret-audit report flags secrets by name reference in workflow YAML. The two GH_AW_* names appear in the lock file purely as optional fallback chain entries that are never set in this repo, but the audit doesn't know that — it sees the name. Suppressing them satisfies the audit with no behavior change: GITHUB_TOKEN is the actual token used in both cases, before and after.

Before / after

Secrets used: block at the top of .github/workflows/java-interop-reviewer.lock.yml:

Before

# Secrets used:
#   - COPILOT_GITHUB_TOKEN
#   - GH_AW_GITHUB_MCP_SERVER_TOKEN
#   - GH_AW_GITHUB_TOKEN
#   - GITHUB_TOKEN

After

# Secrets used:
#   - COPILOT_GITHUB_TOKEN
#   - GITHUB_TOKEN

Both GH_AW_GITHUB_TOKEN and GH_AW_GITHUB_MCP_SERVER_TOKEN are fully removed from the lock file (verified by grepping the full body, not just the comment header).

Changes

• .github/workflows/java-interop-reviewer.md — two github-token: ${{ secrets.GITHUB_TOKEN }} lines added (one under tools.github, one under safe-outputs).
• .github/workflows/java-interop-reviewer.lock.yml — regenerated via gh aw compile (v0.79.8). Zero errors, zero warnings.

Same fix that just landed in dotnet/android for its two gh-aw workflows.

[Copilot]

Pull request overview

Scopes gh-aw workflow token configuration explicitly to GITHUB_TOKEN so the compiled lock workflow no longer references the unused fallback secret names (GH_AW_GITHUB_TOKEN, GH_AW_GITHUB_MCP_SERVER_TOKEN). This aligns with the repo’s actual runtime behavior while satisfying secret-audit tooling that flags secret name references.

Changes:

• Added explicit github-token: ${{ secrets.GITHUB_TOKEN }} configuration under tools.github and safe-outputs in the gh-aw source workflow (.md).
• Regenerated the compiled workflow (.lock.yml) so all token usages and the “Secrets used” manifest drop the GH_AW_* fallback names and reference only GITHUB_TOKEN (plus COPILOT_GITHUB_TOKEN).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
.github/workflows/java-interop-reviewer.md	Adds explicit github-token entries so gh-aw compilation doesn’t emit fallback secret name chains.
.github/workflows/java-interop-reviewer.lock.yml	Regenerated output removing GH_AW_* secret-name references and using only secrets.GITHUB_TOKEN where applicable.