.github - Support adding fork PRs to project board

[MantisClone]

Problem

The add-to-project workflow currently triggers on pull_request events. For PRs from forks (external contributors), GitHub doesn't pass secrets to the workflow for security reasons. This means PRs from external contributors on open-source repos (like the SDK, easyInvoice) won't be automatically added to the project board.

Current behavior:

• External issues → Added to project board ✅
• External PRs with linked issues → Covered via the linked issue ✅
• External PRs without linked issues → Not added to board ❌

Proposed Solution

Change from pull_request to pull_request_target event trigger.

pull_request_target runs in the context of the base branch and has access to secrets, even for fork PRs. This is safe for our use case because:

• We don't checkout or execute any code from the PR
• We only read PR metadata (number, linked issues) and add items to the project board

Changes needed:

1. Update the reusable workflow in .github to use pull_request_target
2. Update all caller workflows across repos (can be done via deployment script)

Considerations

• pull_request_target is generally discouraged because it can be dangerous if you run untrusted code, but our workflow is safe
• Need to verify the workflow still gets correct PR metadata with pull_request_target
• May want to add explicit permissions block for defense in depth

[MantisClone]

This issue is no longer applicable.

The add-to-project workflow has been simplified to only auto-add issues to the project board. PRs are no longer automatically added, regardless of origin (fork or internal).

Rationale: Internal developers sometimes create PRs before linking them to issues, causing unwanted additions to the project board.

Current behavior:

• Issues → Added to project board ✅
• PRs → Not auto-added

PRs without an accompanying issue (e.g., unplanned fixes or discoveries) can still be added to the project board manually. See the GitHub Project Process for details.

See commits fad6edd and 4ca761b for the implementation.