Skip to content

ci: add GHA to add PRs to project board when marked ready for review#4380

Open
MikeGoldsmith wants to merge 3 commits intoopen-telemetry:mainfrom
honeycombio:mike/add-to-project-ready-for-review
Open

ci: add GHA to add PRs to project board when marked ready for review#4380
MikeGoldsmith wants to merge 3 commits intoopen-telemetry:mainfrom
honeycombio:mike/add-to-project-ready-for-review

Conversation

@MikeGoldsmith
Copy link
Copy Markdown
Member

@MikeGoldsmith MikeGoldsmith commented Mar 31, 2026

Description

The Python PR digest board uses a built-in GitHub project workflow to auto-add PRs. However, that workflow only fires on PR `opened` and `reopened` events — it does not fire when a draft PR is converted to ready for review.

This means any PR opened as a draft and later marked ready for review is silently skipped and never added to the board.

This GHA covers the gap by triggering on `opened`, `reopened`, and `ready_for_review`, while skipping drafts. Since it uses `actions/add-to-project` (which is idempotent), PRs opened as non-drafts are safe — they'll just be a no-op on the second trigger.

Mirrors: open-telemetry/opentelemetry-python#5026

Security: `pull_request_target` trigger

This workflow uses `pull_request_target` rather than `pull_request`. This is intentional: `pull_request` does not have access to repository secrets for fork PRs (`Secret source: None`), so the otelbot token would never resolve. `pull_request_target` runs in the base repo context and can access secrets.

The workflow contains no `actions/checkout` step — it never executes any code from the fork, only uses the PR node ID to make a single GitHub API call. See open-telemetry/opentelemetry-python#4955 for the full security discussion.

Prerequisites for org admins

Before this workflow will function after merge, an org admin must grant otelbot the Projects permission:

The board's built-in auto-add workflow only fires on PR open/reopen,
not when a draft is converted to ready for review. This GHA covers
that gap by triggering on opened, reopened, and ready_for_review,
skipping drafts.

Assisted-by: Claude Sonnet 4.6
@MikeGoldsmith
Copy link
Copy Markdown
Member Author

Please add the skip-changelog label.

@tammy-baylis-swi tammy-baylis-swi added the Skip Changelog PRs that do not require a CHANGELOG.md entry label Mar 31, 2026
@tammy-baylis-swi tammy-baylis-swi moved this to Ready for review in Python PR digest Mar 31, 2026
Copy link
Copy Markdown
Contributor

@tammy-baylis-swi tammy-baylis-swi left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sgtm, I fit into this use case. 🙂 Also fine with me that contrib and core PRs are on the same board.

…kflow

pull_request trigger cannot access secrets for fork PRs (Secret source: None).
pull_request_target runs in base repo context and can access secrets.

Use otelbot app token (same pattern as backport.yml) instead of a PAT.
No checkout step — intentional, see open-telemetry/opentelemetry-python#4955.

Assisted-by: Claude Sonnet 4.6
@MikeGoldsmith MikeGoldsmith moved this from Ready for review to Approved PRs in Python PR digest Mar 31, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Skip Changelog PRs that do not require a CHANGELOG.md entry

Projects

Status: Approved PRs

Development

Successfully merging this pull request may close these issues.

2 participants