From 3b3c539ce3be734801b31a45a9f53f9b882b099b Mon Sep 17 00:00:00 2001 From: lukasWuttke <54042461+LukasWodka@users.noreply.github.com> Date: Tue, 18 Aug 2026 09:07:43 +0200 Subject: [PATCH] feat(2036): add-to-kanban authenticates as the App (backend#2036) The last board writer on PROJECTS_KANBAN_TOKEN. A per-repo COPY, so one PR per repo; the content stays byte-identical across the fleet because the guard compares it that way. `owner:` makes the installation token ORG-scoped -- a repo-scoped one cannot write the org project. No fallback to the PAT: a fallback would let a broken App path keep working silently. This workflow also fires on DEPENDABOT PRs, which GitHub gates on a separate secret scope. Both app secrets are set there too; without that, Dependabot PRs would stop reaching the board with `Input required and not supplied` -- the exact failure PROJECTS_KANBAN_TOKEN already had to be dual-scoped to avoid. Refs backend#2036 Co-Authored-By: Claude Opus 5 --- .github/workflows/add-to-kanban.yml | 19 ++++++++++++++++++- 1 file changed, 18 insertions(+), 1 deletion(-) diff --git a/.github/workflows/add-to-kanban.yml b/.github/workflows/add-to-kanban.yml index 603751a..07283e3 100644 --- a/.github/workflows/add-to-kanban.yml +++ b/.github/workflows/add-to-kanban.yml @@ -10,7 +10,24 @@ jobs: add-to-project: runs-on: ubuntu-latest steps: + # Board writes authenticate as the tracebloc-release-train App (backend#2036), + # not a human's PAT. `owner:` yields an ORG-scoped installation token; a + # repo-scoped one cannot write the org project. No fallback to the PAT: a + # fallback would let a broken App path keep working silently. + # + # This workflow also fires on DEPENDABOT PRs, which GitHub gates on a separate + # secret scope -- both app secrets are set there too, or Dependabot PRs would + # stop reaching the board with `Input required and not supplied`. + - name: Mint an installation token + id: app-token + uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0 + with: + app-id: ${{ secrets.RELEASE_TRAIN_APP_ID }} + private-key: ${{ secrets.RELEASE_TRAIN_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + - uses: actions/add-to-project@5afcf98fcd03f1c2f92c3c83f58ae24323cc57fd # v2.0.0 with: project-url: https://github.com/orgs/tracebloc/projects/2 - github-token: ${{ secrets.PROJECTS_KANBAN_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }} +