fix: make pre-activation app token generation resilient to missing app installation

pkg/workflow/compiler_pre_activation_job.go

@@ -482,12 +482,15 @@ func (c *Compiler) extractPreActivationCustomFields(jobs map[string]any) ([]stri
 // buildPreActivationAppTokenMintStep generates a single GitHub App token mint step for use
 // by all skip-if checks in the pre-activation job. The step ID is "pre-activation-app-token".
 // Auth configuration comes from the top-level on.github-app field.
+// The step uses continue-on-error: true so that a missing app installation (HTTP 404) does not
+// fail the pre-activation job; skip-if checks fall back to github.token in that case.
 func (c *Compiler) buildPreActivationAppTokenMintStep(app *GitHubAppConfig) []string {
 	var steps []string
 	tokenStepID := constants.PreActivationAppTokenStepID
 
 	steps = append(steps, "      - name: Generate GitHub App token for skip-if checks\n")
 	steps = append(steps, fmt.Sprintf("        id: %s\n", tokenStepID))
+	steps = append(steps, "        continue-on-error: true\n")
 	steps = append(steps, fmt.Sprintf("        uses: %s\n", GetActionPin("actions/create-github-app-token")))
 	steps = append(steps, "        with:\n")
 	steps = append(steps, fmt.Sprintf("          app-id: %s\n", app.AppID))
@@ -520,9 +523,11 @@ func (c *Compiler) buildPreActivationAppTokenMintStep(app *GitHubAppConfig) []st
 // resolvePreActivationSkipIfToken returns the GitHub token expression to use for skip-if check
 // steps in the pre-activation job. Priority: App token > custom github-token > empty (default).
 // When non-empty, callers should emit `with.github-token: <value>` in the step.
+// When an app is configured the token step uses continue-on-error: true, so the expression
+// falls back to github.token in case the app is not installed on the repository.
 func (c *Compiler) resolvePreActivationSkipIfToken(data *WorkflowData) string {
 	if data.ActivationGitHubApp != nil {
-		return fmt.Sprintf("${{ steps.%s.outputs.token }}", constants.PreActivationAppTokenStepID)
+		return fmt.Sprintf("${{ steps.%s.outputs.token || github.token }}", constants.PreActivationAppTokenStepID)
 	}
 	if data.ActivationGitHubToken != "" {
 		return data.ActivationGitHubToken

pkg/workflow/skip_if_match_test.go

@@ -440,9 +440,9 @@ This workflow uses a GitHub App token for org-wide search.
 			t.Error("Expected owner to be set in GitHub App token mint step")
 		}
 
-		// Verify the minted token is used in the skip-if step via the unified step ID
-		if !strings.Contains(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token }}") {
-			t.Error("Expected minted app token (pre-activation-app-token) to be used in skip-if-match step")
+		// Verify the minted token is used in the skip-if step via the unified step ID (with github.token fallback)
+		if !strings.Contains(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token || github.token }}") {
+			t.Error("Expected minted app token (pre-activation-app-token) with github.token fallback to be used in skip-if-match step")
 		}
 
 		// Verify GH_AW_SKIP_SCOPE is set to "none"

pkg/workflow/skip_if_no_match_test.go

@@ -499,9 +499,9 @@ This workflow uses a GitHub App token for org-wide search.
 			t.Error("Expected owner to be set in GitHub App token mint step")
 		}
 
-		// Verify the minted token is used in the skip-if step via the unified step ID
-		if !strings.Contains(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token }}") {
-			t.Error("Expected minted app token (pre-activation-app-token) to be used in skip-if-no-match step")
+		// Verify the minted token is used in the skip-if step via the unified step ID (with github.token fallback)
+		if !strings.Contains(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token || github.token }}") {
+			t.Error("Expected minted app token (pre-activation-app-token) with github.token fallback to be used in skip-if-no-match step")
 		}
 
 		// Verify GH_AW_SKIP_SCOPE is set to "none"
@@ -563,9 +563,9 @@ Both skip-if-match and skip-if-no-match share one mint step.
 		if !strings.Contains(lockContentStr, "Check skip-if-no-match query") {
 			t.Error("Expected skip-if-no-match check to be present")
 		}
-		// Both reference the same pre-activation-app-token step
-		if strings.Count(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token }}") != 2 {
-			t.Error("Expected both skip-if steps to reference the unified pre-activation-app-token step")
+		// Both reference the same pre-activation-app-token step (with github.token fallback)
+		if strings.Count(lockContentStr, "github-token: ${{ steps.pre-activation-app-token.outputs.token || github.token }}") != 2 {
+			t.Error("Expected both skip-if steps to reference the unified pre-activation-app-token step with github.token fallback")
 		}
 	})
 }