Track issues on the Operations org board#15
Conversation
Auto-add opened/reopened issues to the org-level Operations Kanban board (NextCommerceCo project 10) and document the claim protocol for agent sessions. Requires the org secret ADD_TO_PROJECT_PAT. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
nextcommerce-docs | 90f2621 | Commit Preview URL Branch Preview URL |
Jul 14 2026, 10:38 AM |
![kilo-code-bot[bot]](https://avatars.githubusercontent.com/in/2193792?s=60&v=4){kind=small}
| add-to-project: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - uses: actions/add-to-project@v1.0.2 |
There was a problem hiding this comment.
WARNING: Action pinned to a mutable tag (v1.0.2) instead of an immutable commit SHA.
Pin third-party Actions by full SHA to mitigate tag-mutation / supply-chain hijack, per GitHub Hardening Guides. The version tag can be republished or re-pointed by the maintainer, and downstream workflows will pick up the new code on the next re-run without review.
Suggested remediation: pin to the SHA corresponding to v1.0.2 with the tag as a comment, e.g.:
| - uses: actions/add-to-project@v1.0.2 | |
| - uses: actions/add-to-project@<full-40-char-sha> # v1.0.2 |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
|
|
||
| jobs: | ||
| add-to-project: | ||
| runs-on: ubuntu-latest |
There was a problem hiding this comment.
SUGGESTION: No explicit permissions: block — defaults to the repo's default token scopes.
Best practice for least-privilege workflows is to declare the minimal permissions needed. This job only reads issue metadata; a issues: read grant would suffice and limits blast radius if the PAT or default token is ever compromised.
| runs-on: ubuntu-latest | |
| permissions: | |
| issues: read |
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
|
|
||
| Before starting work on an issue: check it is not assigned to someone else, | ||
| assign yourself (`gh issue edit <n> --add-assignee @me`), and move the card to | ||
| In Progress. Open PRs with `Closes #<n>` so the card moves to Done on merge. |
There was a problem hiding this comment.
SUGGESTION: The statement "the card moves to Done on merge" is not guaranteed by this workflow.
actions/add-to-project@v1 only adds cards (on opened/reopened). It does not move cards to Done when an issue is closed or its linked PR is merged — that requires either the GitHub Projects UI auto-move rules (org-level, not visible here) or a separate workflow (likely in next-mind per the PR description). The phrasing reads as if this repo's automation drives the Done transition, which could mislead agents into assuming a missing card transition is a bug here.
Consider clarifying, e.g.: "Open PRs with Closes #<n> so the card moves to Done via the board's auto-move rules / companion automation."
Reply with @kilocode-bot fix it to have Kilo Code address this issue.
Code Review SummaryStatus: No Issues Found | Recommendation: Merge The incremental commits (43ba7c8 → 90f2621) address the previously reported concerns:
The previously unresolved WARNING (mutable-tag action pin) and SUGGESTION (missing Files Reviewed (2 files)
Previous Review Summaries (2 snapshots, latest commit 43ba7c8)Current summary above is authoritative. Previous snapshots are kept for context only. Previous review (commit 43ba7c8)Status: 3 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Fix these issues in Kilo Cloud Previous review (commit 7b62256)Status: 3 Issues Found | Recommendation: Address before merge Overview
Issue Details (click to expand)WARNING
SUGGESTION
Files Reviewed (2 files)
Reviewed by minimax-m3 · Input: 21.8K · Output: 1.8K · Cached: 152.5K |
…er-author gate Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
campaigns-os and docs are public; the board-conventions doc lives in the private next-mind repo. Point contributors to the /next-board skill instead of the private path. Fixes the forbidden-private-strings check. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…n board automation - timeout-minutes: 5 (default 360 is too high for add-to-project) - reword the Done transition to name the board's built-in 'Item closed' workflow rather than implying this repo's workflow drives it Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
1 participant
Adds this repo to the org-level Operations Kanban board (Todo / In Progress / Done) that coordinates Brett's and Devin's work across next-mind, campaigns-os, nextcommerce-site, guides, and docs.
.github/workflows/add-to-project.yml— auto-adds opened/reopened issues to the boardCloses #<n>in PRs)Prerequisite: the workflow needs the org Actions secret
ADD_TO_PROJECT_PAT(classic PAT with repo + project scopes, shared to this repo). Until it's set, the Action will fail and issues must be added to the board manually.Companion PR with full conventions + the
/next-boardskill: NextCommerceCo/next-mind#602🤖 Generated with Claude Code