fix: add missing token to first-time contributor welcome workflow

[MathurAditya724]

🔗 Linked issue

N/A — discovered from a failing CI job on #2262

🧭 Context

The "Greet First-Time Contributors" workflow (added in #2236) fails on every new contributor's PR because a required action input is missing.

📚 Description

The zephyrproject-rtos/action-first-interaction action requires a repo-token input to authenticate with the GitHub API, but it wasn't being supplied. This adds repo-token: ${{ secrets.GITHUB_TOKEN }} to the workflow. The workflow already has permissions: pull-requests: write so no additional permission changes are needed.

Failing job: https://github.com/npmx-dev/npmx.dev/actions/runs/23489827599/job/68354800411?pr=2262

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
npmx.dev	Ready	Preview, Comment	Mar 24, 2026 2:48pm

2 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
docs.npmx.dev	Ignored		Mar 24, 2026 2:48pm
npmx-lunaria	Ignored		Mar 24, 2026 2:48pm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

[trueberryless]

LGTM 🎉

Thanks, I missed that in #2236

[ghostdevv]

It's still broken but maybe merging will help 🤔

[trueberryless]

It's still broken but maybe merging will help 🤔

Yes, that's expected because the trigger is pull_request_target which will read the main branch, and since it was not merged when the PR is created, it reads the old action. 👍

[ghostdevv]

It's still broken but maybe merging will help 🤔

Yes, that's expected because the trigger is pull_request_target which will read the main branch, and since it was not merged when the PR is created, it reads the old action. 👍

ahhh TIL