ci: add fork pull requests to the project from base context

[jdx]

Fork pull requests fail the project-board workflow with Input required and not supplied: github-token, as seen on #176. The workflow uses pull_request, which does not receive the base repository's PROJECT_PAT for fork contributions. Recent same-repository PR and issue runs succeeded.

Use pull_request_target for this metadata-only action so GitHub runs the base repository's workflow with its existing project token. The job does not check out or execute contributor code, and its implicit GITHUB_TOKEN receives no permissions. Keep the issue-opened behavior and include PR reopening so existing contributions can trigger project addition after this fix lands.

Validated with actionlint 1.7.12 and git diff --check. Confirmed that actions/add-to-project@v1.0.2 reads the issue/PR payload and uses the explicitly supplied token. Live verification requires merging this workflow into the base repository; retrying the existing fork pull_request run with its old workflow will still withhold the secret.

GitHub documents the base-context behavior and restrictions here: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows#pull_request_target

AI-assisted — Tool: Codex; model: OpenAI/unavailable; version: unavailable.

Summary by CodeRabbit

• Chores
  • Project tracking automation now adds pull requests when they are opened or reopened, helping keep the project board up to date.
  • Existing issue tracking behavior remains unchanged.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: cb6d4ab6-ccb8-4409-9ee8-5f99f12850cb

📥 Commits

Reviewing files that changed from the base of the PR and between aff8423 and ab4a9a8.

📒 Files selected for processing (1)

• .github/workflows/add-to-project.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The workflow now handles pull requests when they are opened or reopened. It declares empty workflow permissions and adds comments about project access and pull request code execution.

Changes

Project workflow

Layer / File(s)	Summary
Pull request trigger and permissions .github/workflows/add-to-project.yml	The workflow uses pull_request_target for opened and reopened pull requests. It declares empty workflow permissions and documents the use of PROJECT_PAT without checking out or executing pull request code.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~8 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to ab4a9

The workflow can add opened or reopened pull requests to the project without running contributor code. No material merge risk is established by this change.

Architecture Summary

Architecture risk: 🔵 Low · up to ab4a9

The changed surface does not map to a changed system, dependency edge, entrypoint, or external dependency.

Changed systems: None identified.

Architecture concerns
No architecture-level concerns identified.

Review details

Before / after behavior

• observed — Modified behavior in .github/workflows/add-to-project.yml: The pull request trigger changes from pull_request on opened to pull_request_target on opened and reopened. The workflow also adds comments about using the base repository’s workflow and secret without executing pull request code, and sets workflow permissions to empty.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: using base-repository context to add fork pull requests to the project.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create a new PR

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}