From 806fe9e145fd8303c4cf8a5fe8d701fe90cb38d7 Mon Sep 17 00:00:00 2001 From: Hai Huang Date: Tue, 3 Nov 2026 10:34:55 -0500 Subject: [PATCH] CI: Pass only ADD_TO_PROJECT_PAT to the add-to-project workflow project.yml runs on pull_request_target and passed secrets: inherit, so the shared add-to-project workflow in rossoctl/.github received every secret of this repo. That workflow reads only ADD_TO_PROJECT_PAT. Pass that one secret by name. The @main pin stays, so the shared workflow still updates automatically. Needs rossoctl/.github#137, which declares the secret. Without it the workflow fails with "ADD_TO_PROJECT_PAT is not defined in the referenced workflow". Part of #1641 Assisted-By: Claude (Anthropic AI) Signed-off-by: Hai Huang --- .github/workflows/project.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/project.yml b/.github/workflows/project.yml index 38ff202a2..666b2618f 100644 --- a/.github/workflows/project.yml +++ b/.github/workflows/project.yml @@ -20,4 +20,6 @@ jobs: # Pinned to @main intentionally: org-internal workflows propagate updates automatically. uses: rossoctl/.github/.github/workflows/add-to-project.yml@main - secrets: inherit + # Only the token the called workflow reads, not every secret of this repo. + secrets: + ADD_TO_PROJECT_PAT: ${{ secrets.ADD_TO_PROJECT_PAT }}