Auto-add pull requests and issues to GitHub projects

[nedbat]

Task: update the bot to automatically add new pull requests and issues to projects.

Back story: we did this with GitHub Actions (for example: openedx/credentials-themes#559), but there are two problems that would be intricate to solve:

• it adds draft pull requests to the project
• it will not add pull requests from other forks
  • issue about this: Action does not work on PRs from forks actions/add-to-project#163
  • that points to a security concern: https://securitylab.github.com/research/github-actions-preventing-pwn-requests

The bot should do this work. We need to design how it should work:

• The bot currently only looks at pull requests, so it will only add pull requests, not issues.
  • Issues can be handled by the shared GitHub action: add-issue-to-a-project.yml
• Should the bot only add "external contribution" PRs (OSPRs) to the project, or all pull requests?
  • I'm assuming it should be only OSPRs.
• Draft pull requests: should it never add them, always add them, or do different projects have strong opinions that differ?
  • It will not add draft pull requests to project.
  • It will add a pull request to a project if it transitions from draft to ready.
  • "Draft" is determined the same way the bot already does:
    • Either the pull request is literally a draft (in GitHub terms),
    • or it has the words "wip" or "WIP" in the title.
• Configuration: the project to add to will be indicated by metadata in the catalog-info.yml file.
  • Do we have a reason now to need to add to more than one project?
    • It will support multiple projects (easy enough to do right the first time)
• Should it ever remove items from a project? For example, if a pull request is switched to draft mode?
  • For the first iteration, we won't remove from projects. Project automation can remove closed pull requests from the project.

[sarina]

Curious why you can't modify https://github.com/openedx/.github/blob/master/workflow-templates/add-new-issues-to-a-project.yml#L8-L10 to just fire on opened PRs as well

edit: I see, there are other criteria

[feanil]

This generally sounds good, specific thoughts below.

Should the bot only add "external contribution" PRs (OSPRs) to the project, or all pull requests?
* I'm assuming it should be only OSPRs.

This makes sense to me to start and we can always make the behavior configurable in the future.

• or it has the words "wip" or "WIP" in the title.

Should we get rid of this now that Draft PRs are common? It feels like a special incantation that not everyone would know about.

[nedbat]

or it has the words "wip" or "WIP" in the title.

Should we get rid of this now that Draft PRs are common? It feels like a special incantation that not everyone would know about.

We seem to still get a few WIP: https://github.com/pulls?q=is%3Aopen+is%3Apr+wip+archived%3Afalse+org%3Aopenedx