From 1ba12a03eac29a80ec78da668bbcc2aba28c8521 Mon Sep 17 00:00:00 2001 From: Nicolas Carenton Date: Fri, 6 Nov 2026 11:57:49 +0100 Subject: [PATCH] ci: replace the add-to-project PAT with a GitHub App token (#376) GITHUB_TOKEN cannot write to an organization project. Instead of a personal access token, create a short-lived GitHub App installation token, limited to organization projects. Read the project URL from the shared XTM_INTEGRATIONS_PROJECT_URL organization variable instead of the per-repository PROJECT_URL. Pin add-to-project to a commit SHA and drop the default GITHUB_TOKEN permissions, which the job does not use. Co-Authored-By: Claude Opus 5.5 --- .../workflows/integrations-add-to-project.yml | 21 ++++++++++++++++--- 1 file changed, 18 insertions(+), 3 deletions(-) diff --git a/.github/workflows/integrations-add-to-project.yml b/.github/workflows/integrations-add-to-project.yml index 70453b87..c5a6777b 100644 --- a/.github/workflows/integrations-add-to-project.yml +++ b/.github/workflows/integrations-add-to-project.yml @@ -9,12 +9,27 @@ on: types: - opened +permissions: {} + jobs: add-to-project: name: Add issue to project runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@v1.0.2 + # GITHUB_TOKEN has no permission on an organization project, so the token + # comes from the installation of a GitHub App on the project's + # organization. The issue or pull request is public, so the token needs no + # permission on this repository to read it. + - name: Generate GitHub App token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ vars.ADD_TO_PROJECT_APP_ID }} + private-key: ${{ secrets.ADD_TO_PROJECT_APP_PRIVATE_KEY }} + owner: FiligranHQ + permission-organization-projects: write + + - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2 with: - project-url: ${{ vars.PROJECT_URL }} - github-token: ${{ secrets.ADD_TO_PROJECT_PAT }} + project-url: ${{ vars.XTM_INTEGRATIONS_PROJECT_URL }} + github-token: ${{ steps.app-token.outputs.token }}