From 39ec27e69b5791180dbf354a1dd64ea8ad97ad8e Mon Sep 17 00:00:00 2001 From: Dustin Byrne Date: Wed, 19 Aug 2026 18:07:15 -0400 Subject: [PATCH 1/2] chore: update flags project workflow SHA --- .github/workflows/call-flags-project-board.yml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/.github/workflows/call-flags-project-board.yml b/.github/workflows/call-flags-project-board.yml index da7b8338b..e2f427490 100644 --- a/.github/workflows/call-flags-project-board.yml +++ b/.github/workflows/call-flags-project-board.yml @@ -9,13 +9,11 @@ on: jobs: call-flags-project: - uses: PostHog/.github/.github/workflows/flags-project-board.yml@a0b36e0021c4bf3d8a5d99972ac993ae54686ba8 + uses: PostHog/.github/.github/workflows/flags-project-board.yml@95c20087fda2dc10fbbbcc3f1ef32b7bae779339 with: pr_number: ${{ github.event.pull_request.number }} pr_node_id: ${{ github.event.pull_request.node_id }} is_draft: ${{ github.event.pull_request.draft }} - # The central .github reusable workflow does not declare workflow_call.secrets, - # so explicit secret mapping makes GitHub reject this caller at startup. - # It gates fork/Dependabot PRs before using secrets; keep this scoped call - # as an intentional exception to the broad-inheritance Semgrep rule. - secrets: inherit # nosemgrep + secrets: + PROJECT_BOARD_BOT_APP_ID: ${{ secrets.PROJECT_BOARD_BOT_APP_ID }} + PROJECT_BOARD_BOT_PRIVATE_KEY: ${{ secrets.PROJECT_BOARD_BOT_PRIVATE_KEY }} From 41e2df1270b08d34702c3ae98f9e6ad908849deb Mon Sep 17 00:00:00 2001 From: Dustin Byrne Date: Wed, 19 Aug 2026 18:24:13 -0400 Subject: [PATCH 2/2] chore: set project workflow permissions --- .github/workflows/call-flags-project-board.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/call-flags-project-board.yml b/.github/workflows/call-flags-project-board.yml index e2f427490..c2bc935d2 100644 --- a/.github/workflows/call-flags-project-board.yml +++ b/.github/workflows/call-flags-project-board.yml @@ -7,6 +7,8 @@ on: pull_request: types: [opened, ready_for_review, review_requested, synchronize, converted_to_draft, reopened] +permissions: {} + jobs: call-flags-project: uses: PostHog/.github/.github/workflows/flags-project-board.yml@95c20087fda2dc10fbbbcc3f1ef32b7bae779339