chore: add workflow to auto-add issues and PRs to NemoClaw Development Tracker

[wscurran]

Summary

Adds a GitHub Actions workflow that automatically adds all new issues and pull requests to the NemoClaw Development Tracker project (project #199) with Status = No Status (the default).

Changes

• New file: .github/workflows/add-to-project.yml
• No changes to issue or PR templates — project assignment is handled entirely at the workflow level
• Uses pull_request_target for PRs to handle fork contributors (consistent with pr-limit.yaml)

⚠️ Required before merging

The workflow references ${{ secrets.ADD_TO_PROJECT_PAT }} — a PAT with project scope. Please confirm this secret exists in Settings → Secrets and variables → Actions, or add it before merging.

Testing

• Open a test issue — confirm it appears in the NemoClaw Development Tracker project with No Status
• Open a test PR — confirm it also appears in the project
• Check Actions tab to confirm the workflow ran without auth errors

Summary by CodeRabbit

• Chores
  • Added automated workflow to streamline project management for issues and pull requests.

[coderabbitai]

📝 Walkthrough

Walkthrough

Introduces a GitHub Actions workflow that automatically adds newly opened issues and pull requests to a specified GitHub Project board using the add-to-project action with repository secret authentication.

Changes

Cohort / File(s)	Summary
GitHub Actions Workflow Configuration .github/workflows/add-to-project.yml	New workflow configured to trigger on issue and pull request open events, executing the add-to-project action to automatically manage project board assignments using a project URL and authentication token.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

🐰 Hop, hop, hooray! A workflow so neat,
Issues and PRs find their project seat,
No manual labor, just automation's sweet beat,
The board fills itself—what a treat! 🎉

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and specifically describes the main change: adding a GitHub Actions workflow to automatically add issues and PRs to the NemoClaw Development Tracker project.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch project-management

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Tip

CodeRabbit can scan for known vulnerabilities in your dependencies using OSV Scanner.

OSV Scanner will automatically detect and report security vulnerabilities in your project's dependencies. No additional configuration is required.

[coderabbitai]

Actionable comments posted: 1

🧹 Nitpick comments (1)

.github/workflows/add-to-project.yml (1)

9-17: Declare explicit workflow permissions (least privilege).

Please add an explicit permissions: block for this job/workflow so defaults don’t drift to broader access than needed.

🛠️ Suggested permissions block

 jobs:
   add-to-project:
     name: Add to NemoClaw Development Tracker
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: read
+      pull-requests: read
     steps:

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/add-to-project.yml around lines 9 - 17, The workflow does
not specify explicit permissions, which can lead to broader access than
necessary. Add a `permissions:` block to the job or workflow and specify only
the minimum required permissions for the actions to run securely, such as
`contents: read` and `workflows: write` or others relevant to the add-to-project
action in the YAML file to enforce least privilege.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.github/workflows/add-to-project.yml:
- Around line 14-17: Replace the mutable action tag
"actions/add-to-project@v1.0.2" with a specific immutable commit SHA to prevent
supply-chain risk; update the "uses" line to
"actions/add-to-project@<commit-sha>" (use the exact commit SHA from the
action's repository), keep the existing "project-url" and the secret
"ADD_TO_PROJECT_PAT" intact, and verify the chosen SHA corresponds to the
intended release before committing the change.

---

Nitpick comments:
In @.github/workflows/add-to-project.yml:
- Around line 9-17: The workflow does not specify explicit permissions, which
can lead to broader access than necessary. Add a `permissions:` block to the job
or workflow and specify only the minimum required permissions for the actions to
run securely, such as `contents: read` and `workflows: write` or others relevant
to the add-to-project action in the YAML file to enforce least privilege.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 7a275890-1860-4068-8aff-ede003a3fa04

📥 Commits

Reviewing files that changed from the base of the PR and between 3aaef13 and c8fb1e7.

📒 Files selected for processing (1)

• .github/workflows/add-to-project.yml

[coderabbitai]

⚠️ Potential issue | 🟠 Major

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify whether workflow actions are pinned to immutable SHAs.
# Expected: lines use `owner/repo/path@<40-hex-sha>` for third-party actions.
rg -n '^\s*-\s*uses:\s*' .github/workflows | sed 's/^/FOUND: /'

Repository: NVIDIA/NemoClaw

Length of output: 149

---

🏁 Script executed:

cat -n .github/workflows/add-to-project.yml

Repository: NVIDIA/NemoClaw

Length of output: 568

---

🏁 Script executed:

# Check all workflows for other version-tagged actions
rg -n '^\s*-\s*uses:\s*\w+/' .github/workflows -A 3 | head -50

Repository: NVIDIA/NemoClaw

Length of output: 401

---

Pin the third-party action to a commit SHA before using PAT secrets.

actions/add-to-project@v1.0.2 is a mutable tag. Since this step consumes ADD_TO_PROJECT_PAT, pin to an immutable commit SHA to reduce supply-chain risk.

🔒 Suggested hardening patch

-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@<full_commit_sha>
         with:
           project-url: https://github.com/orgs/NVIDIA/projects/199
           github-token: ${{ secrets.ADD_TO_PROJECT_PAT }}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/add-to-project.yml around lines 14 - 17, Replace the
mutable action tag "actions/add-to-project@v1.0.2" with a specific immutable
commit SHA to prevent supply-chain risk; update the "uses" line to
"actions/add-to-project@<commit-sha>" (use the exact commit SHA from the
action's repository), keep the existing "project-url" and the secret
"ADD_TO_PROJECT_PAT" intact, and verify the chosen SHA corresponds to the
intended release before committing the change.