[huang195]

Problem

Part of #1641.

project.yml runs on pull_request_target and passes secrets: inherit. So the shared add-to-project.yml in rossoctl/.github receives every secret of this repo, but it reads only ADD_TO_PROJECT_PAT.

The same admins control both repos, so this is hygiene, not an escalation: a person who can change rossoctl/.github can already push a workflow here. But there is no reason to pass secrets that the workflow does not use. OpenSSF Scorecard, which this repo runs, also flags this pattern.

Change

Pass only ADD_TO_PROJECT_PAT, by name. The @main pin stays, so the shared workflow still updates automatically.

Merge order

Merge rossoctl/.github#137 first. It declares ADD_TO_PROJECT_PAT in the shared workflow. Without that declaration, this workflow fails with Invalid secret, ADD_TO_PROJECT_PAT is not defined in the referenced workflow.

Verification

• The file parses as YAML.
• The workflow runs only when an issue or PR opens, so this PR cannot exercise its own change: pull_request_target uses the workflow from main. The first real check is the first issue or PR after the merge. Its "Add item to Rossoctl Project" run must pass.

Assisted-By: Claude (Anthropic AI) noreply@anthropic.com

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 43 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

Learn how review limits work.

Review configuration:

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: 2b56adf3-7e69-451a-8bbe-79004c2fb3c2

Commits

Reviewing files that changed from the base of the PR and between d4da0e7 and 806fe9e.

Files selected for processing: 1

• .github/workflows/project.yml

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

CodeRabbit Verify

• Run CodeRabbit Verify to test the changes in this pull request.

[clawgenti]

Summary

This replaces secrets: inherit with a single named secret, ADD_TO_PROJECT_PAT, in the pull_request_target caller of the shared add-to-project workflow. The shared workflow (rossoctl/.github add-to-project.yml@main) reads only secrets.ADD_TO_PROJECT_PAT, so behavior stays the same and the called workflow no longer receives the rest of this repo's secrets. project.yml was the only secrets: inherit left in this repo's workflows. No blocking issues.

The one thing to watch is merge order. rossoctl/.github#137, which declares the secret under workflow_call.secrets, is approved but not merged yet. If this PR merges first, every issue/PR-opened run fails at workflow load time with Invalid secret ... not defined in the referenced workflow. The step-level continue-on-error in the called workflow does not cover that failure. Please merge #137 first, as the description says.

Author: huang195 (MEMBER — maintainer)
Areas reviewed: CI/GitHub Actions, YAML, Security
Agent/IDE config (.claude/.vscode): none
Commits: 1 commit, all signed-off: yes
CI status: passing (a few unrelated Go/pre-commit jobs still pending; the pull_request_target run uses the workflow from main, so it does not test this change)

[clawgenti]

suggestion: This depends on rossoctl/.github#137, which is still open. Until that PR declares ADD_TO_PROJECT_PAT in on.workflow_call.secrets, GitHub rejects this caller at load time, and the step's continue-on-error does not apply. Please merge #137 first. After both merge, open a test issue to confirm the "Add item to Rossoctl Project" run still adds it to the project.