From b10ee8be264cbf75a83998a3b9cb39359ee2eacb Mon Sep 17 00:00:00 2001 From: Ahmed Khalid <106074266+ahmed-arb@users.noreply.github.com> Date: Wed, 16 Sep 2026 20:22:51 +0500 Subject: [PATCH] ci: authenticate project automation with a GitHub App The auto-add workflow used a personal access token belonging to a single maintainer. That maintainer left the organisation, so the token can no longer write to the org project and every run fails with: regisb does not have the correct permissions to execute `AddProjectV2ItemById` Mint a short-lived installation token from the organisation-owned tutor-project-automation App instead, so the workflow no longer depends on any one person's account. Also bump add-to-project to v2.0.0, which runs on Node 24; the previous pin targets the deprecated Node 20. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/auto-add-to-project.yml | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-) diff --git a/.github/workflows/auto-add-to-project.yml b/.github/workflows/auto-add-to-project.yml index 0e12752..0f90d6e 100644 --- a/.github/workflows/auto-add-to-project.yml +++ b/.github/workflows/auto-add-to-project.yml @@ -14,7 +14,17 @@ jobs: name: Add issue and bugs to project runs-on: ubuntu-latest steps: - - uses: actions/add-to-project@v1.0.2 + # Mint a short-lived token from the organisation-owned GitHub App, so that + # adding items to the project does not depend on any one maintainer's + # personal access token. + # https://github.com/actions/create-github-app-token + - uses: actions/create-github-app-token@v3.2.0 + id: app-token + with: + app-id: ${{ secrets.PROJECT_APP_ID }} + private-key: ${{ secrets.PROJECT_APP_PRIVATE_KEY }} + owner: ${{ github.repository_owner }} + - uses: actions/add-to-project@v2.0.0 with: project-url: https://github.com/orgs/overhangio/projects/4 - github-token: ${{ secrets.GH_PROJECT_PERSONAL_ACCESS_TOKEN }} + github-token: ${{ steps.app-token.outputs.token }}