[agent-issue]: align GitHub issue-reporting token variable names

[jamesadevine]

Submission requirements

• I generated this issue with an agent that used the repository's ado-aw guidance.
• I reviewed the generated issue and confirm it is being filed directly in githubnext/ado-aw.

Problem summary

The same GitHub fine-grained PAT contract—an executor/harness-only token scoped
to create failure-reporting issues—is represented by three ADO pipeline
variable names:

• ADO_AW_DEBUG_GITHUB_TOKEN
• EXECUTOR_E2E_GITHUB_TOKEN
• TRIGGER_E2E_GITHUB_TOKEN

This makes token rotation and pipeline setup unnecessarily error-prone. A single
credential rotation currently requires setting three differently named
variables across the release/candidate failure reporters and both deterministic
E2E orchestrators.

The issue-reporting PAT must remain distinct from GITHUB_TOKEN, which
authenticates the Copilot CLI.

Reproduction details

Current consumers:

• src/safe_outputs/result.rs loads ADO_AW_DEBUG_GITHUB_TOKEN for
  ado-aw-debug.create-issue.
• tests/executor-e2e/azure-pipelines.yml maps
  EXECUTOR_E2E_GITHUB_TOKEN.
• tests/trigger-e2e/azure-pipelines.yml maps
  TRIGGER_E2E_GITHUB_TOKEN.
• scripts/ado-script/src/executor-e2e/github-issue.ts and
  scripts/ado-script/src/trigger-e2e/github-issue.ts already fall back to
  ADO_AW_DEBUG_GITHUB_TOKEN, demonstrating that these names represent the
  same underlying capability.

The duplication is also repeated throughout setup documentation and secret
rotation scripts.

Proposed next step

Choose one capability-oriented canonical name, for example
ADO_AW_GITHUB_ISSUES_TOKEN, and migrate every issue-reporting consumer to it.

Suggested acceptance criteria:

1. Release and candidate smoke reporters, executor E2E, and trigger E2E use one
   documented canonical ADO secret-variable name.
2. The canonical variable remains executor/harness-only and is never exposed to
   Stage 1.
3. GITHUB_TOKEN remains a separate Copilot authentication credential.
4. Existing names are accepted as deprecated aliases for a bounded migration
   window, with deterministic precedence and tests.
5. Compiler output, TypeScript harnesses, tests, examples, runbooks, registered
   pipeline instructions, and rotation scripts are updated together.
6. The migration documents which AgentPlayground definitions require the
   renamed variable and how operators can rotate it safely.

[github-actions]

🏷️ Triaged

Labeled as rust, javascript (in addition to existing refactor).

Why: This issue proposes consolidating three differently-named ADO pipeline variables (ADO_AW_DEBUG_GITHUB_TOKEN, EXECUTOR_E2E_GITHUB_TOKEN, TRIGGER_E2E_GITHUB_TOKEN) that represent the same credential. The changes span Rust source (src/safe_outputs/result.rs) and TypeScript harnesses (scripts/ado-script/src/executor-e2e/, trigger-e2e/), so both area labels apply. The existing refactor label correctly captures the nature of the change.

_{Automated triage — a maintainer can adjust labels anytime.}

Generated by Issue Triage for #1632 · 17.3 AIC · ⌖ 5.72 AIC · ⊞ 6.2K · ◷