Grant the automation secrets, including the missing bot credentials

[akolson]

Overview

This repo can see one organization secret, PYPI_API_TOKEN. It cannot see LE_BOT_APP_ID or
LE_BOT_PRIVATE_KEY, which every bot automation needs. As a result the existing automation here has
been failing since at least August. Grant the two required secrets, and the five optional ones.

Complexity: Low
Target branch: Not applicable. This is an organization settings change, not a code change.

Context

The automations generate a token with actions/create-github-app-token, using LE_BOT_APP_ID and
LE_BOT_PRIVATE_KEY. Neither is visible here, so the value arrives as an empty string and the first
step fails. Run 33453822106 shows it:

Error: The 'client-id' (or deprecated 'app-id') input must be set to a non-empty string.
If using a secret or variable, ensure it is available in this workflow context.

This predates the migration. It is not caused by learningequality/.github#88, and #353 does not fix
it. But the migration does widen it. Today three automations fail here. After #353 merges, twelve
fail, because every automation except resolve-bot-pr-threads starts by generating that token. The
failures would then look like the migration broke this repo.

Five further secrets are optional, and four automations use them:

Automation	Secrets it needs
contributor-pr-reply	SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL
contributor-issue-comment	SLACK_WEBHOOK_URL, SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL
update-pr-spreadsheet	CONTRIBUTIONS_SPREADSHEET_ID, CONTRIBUTIONS_SHEET_NAME, GH_UPLOADER_GCP_SA_CREDENTIALS
unassign-inactive-issues	SLACK_COMMUNITY_NOTIFICATIONS_WEBHOOK_URL

An absent secret does not disable its automation. The caller forwards every key, so the value
arrives as an empty string and the step fails at run time.

All four sit behind the contributor check, which is true for anyone who is not a core team member.
A private repo therefore needs none of them, because no outside account can open a pull request or
comment there. This repo is public, so an outside contributor can arrive at any time.

The Change

Grant this repo visibility of seven organization secrets:

• LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY, which are required and fix the current failures.
• The five in the table above, which the community automations need.

Out of Scope

• Any change to the workflows. The migration in Migrate to the shared automation.yml entry point #353 covers that.
• Investigating why the visibility was never granted. Fix it first.

Acceptance Criteria

• All seven secrets appear in this repo's visible organization secrets.
• The existing call-pull-request-target.yml run succeeds on a new pull request, before Migrate to the shared automation.yml entry point #353
  merges.
• After Migrate to the shared automation.yml entry point #353 merges, a pull request from a non-member runs the Automation workflow with no
  failed step.

Testing

1. Open repos/learningequality/morango/actions/organization-secrets and confirm that all seven
   names are listed.
2. Open a test pull request and request a review on it. Confirm that the Generate App Token step
   succeeds, where it fails today.
3. After Migrate to the shared automation.yml entry point #353 merges, repeat with an account that is not an organization member, and confirm that no
   step fails.

References

• Migrate to the shared automation.yml entry point #353 is the migration pull request for this repo.
• Migrate to the shared automation-template.yml entry point #352 is the migration issue.
• Consolidate shared workflows into a single generated automation.yml entry point .github#88 introduces the shared template.
• Run 33453822106 in this repo shows the current failure.
• docs/automation.md in learningequality/.github lists every secret and says which are optional.

AI usage

I used Claude Code to audit organization secret visibility across the eight repos migrating to the
shared template, and to draft this issue from the result. I confirmed the secret list, traced the
failing run to the empty app-id input, checked the organization membership of the authors named
above, and edited the wording.

[rtibbles]

Fixed.

[akolson]

@rtibbles, looks like LE_BOT_APP_ID and LE_BOT_PRIVATE_KEY are still missing?