From 6ddffb35e0493043548ee1609c197b3b364312e6 Mon Sep 17 00:00:00 2001 From: borjaperfra Date: Mon, 21 Sep 2026 18:35:02 +0200 Subject: [PATCH] chore(ci): que el tablero recoja tambien los PR de fuera GitHub no entrega secretos a un workflow disparado por un fork, asi que ADD_TO_PROJECT_PAT llegaba vacio y la accion moria en "Input required and not supplied: github-token". El tablero se perdia justo los PR que nadie del equipo iba a meter a mano, y quien contribuye desde fuera veia un check rojo en su primera aportacion: la #25 lleva asi desde el 16 de septiembre. pull_request_target corre en el contexto del repo base, donde el secreto existe. Eso renuncia al aislamiento que hace seguro a pull_request, y el precio solo sale a cuenta por lo que este job no hace: no clona el PR, no ejecuta nada suyo y no lee su contenido. La unica entrada es una URL escrita en el propio fichero. El GITHUB_TOKEN del job se queda ademas sin permisos: la accion usa el PAT, y con pull_request_target un token por defecto con escritura es lo que convierte un fallo tonto en uno caro. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/add-to-project.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/add-to-project.yml b/.github/workflows/add-to-project.yml index 350c1d7..2572a75 100644 --- a/.github/workflows/add-to-project.yml +++ b/.github/workflows/add-to-project.yml @@ -1,11 +1,27 @@ name: Auto-add to NaN Staff project +# pull_request_target, not pull_request, because of where the secret lives. +# GitHub does not hand secrets to a workflow run from a fork, so on an outside +# contribution ADD_TO_PROJECT_PAT arrived empty and the action stopped at +# `Input required and not supplied: github-token`. The board missed exactly the +# pull requests nobody on the team was going to file by hand, and the person +# saw a red check on their first contribution - #25 sat like that for five days. +# +# pull_request_target runs in the context of the base repository, where the +# secret exists. That trades away the isolation that makes pull_request safe, +# and the price is only acceptable because of what this job does not do: it +# never checks out the pull request, never runs anything from it, and never +# reads its contents. The only input is a project URL written here. Anything +# added below that touches the contributor's code has to move back to +# pull_request, or it runs that code with a token that can write to the org. on: issues: types: [opened, reopened, transferred] - pull_request: + pull_request_target: types: [opened, reopened] +permissions: {} + jobs: add-to-project: runs-on: ubuntu-latest