Split author and reviewer tokens

action.yml

@@ -5,8 +5,15 @@ inputs:
   bot-type:
     description: Which bot to run, either `codex` or `claude`
     required: true
-  gitea-token:
-    description: Gitea access token for API calls and pushes
+  author-token:
+    description: >-
+      Gitea token of the account that commits, pushes, and opens pull requests.
+      The agent sees it as `GITEA_TOKEN`.
+    required: true
+  reviewer-token:
+    description: >-
+      Gitea token of the bot account that posts comments and pull request
+      reviews. Never exposed to the agent, so it must differ from the author.
     required: true
   bot-token:
     description: API key or token for the selected bot
@@ -29,7 +36,8 @@ runs:
         ACTION_PATH: ${{ gitea.action_path }}
         GITEA_API_URL: ${{ gitea.api_url }}
         GITEA_REPOSITORY: ${{ gitea.repository }}
-        GITEA_TOKEN: ${{ inputs.gitea-token }}
+        GITEA_TOKEN: ${{ inputs.author-token }}
+        REVIEWER_TOKEN: ${{ inputs.reviewer-token }}
         BOT_TOKEN: ${{ inputs.bot-token }}
         EVENT_NAME: ${{ gitea.event_name }}
         ISSUE_INDEX: ${{ gitea.event.issue.number || gitea.event.pull_request.number }}