Create a project board for tracking community PR review progress

[GuySartorelli]

As part of adding the new peer reviewer and refiner roles, we should provide a project board that these community roles can use to organise and track their work.

Epic

• EPIC: Empower community members to be more involved in Silverstripe CMS OSS #141

Acceptance Criteria

• A new GitHub project board is created for tracking community pull request review progress
• All teams have access to the board
  • Probably the refiners should have view-only access, if that's possible
• The project board is documented on either the maintainer guidelines page, triage and peer review page, or both
• The "Backlog with PRs" column in zenhub is removed, in favour of using the new project board for tracking community PRs
• If possible, all issues with a pull request are displayed in the project board
  • Otherwise, all issues are displayed on the project board
  • NOTE: Opted to list PRs in the end because that's ultimately what people need to review, and that's much easier than finding the 5 different ways PRs can be "related" to an issue in order to know when an issue should be added

TO DECIDE (or explicitly leave it up to whoever implements it)

• What columns do we want? Examples below
  • New issues
  • Needs review (has a PR but isn't being reviewed yet)
  • In review (must be assigned to the person reviewing)
  • Awaiting contributor feedback (must be assigned to the person who requested feedback)
  • Needs escalation (core committers or CMS squad need to take a look)
  • Needs second approval
  • Done/Merged (HIDDEN)

We'll aim to review these column early once we start having some contributors on-boarded. So we'll go with the initial suggested column.

NOTE about using secrets in GitHub Actions

https://docs.github.com/en/actions/learn-github-actions/contexts#secrets-context

If a secret was used in the job, GitHub automatically redacts secrets printed to the log. You should avoid printing secrets to the log intentionally.

In other words, so long as we're not echoing it out ourselves, there should be no risk of our secret being exposed via logs.

Project board

• https://github.com/orgs/silverstripe/projects/4

PRs

• NEW Create GitHub Action for adding PRs to the new project gha-add-pr-to-project#1
• ENH Add new silverstripe/gha-add-pr-to-project repo supported-modules#35
• NEW Add script for new action that adds PRs to project module-standardiser#59
• FIX Don't try to use option when it doesn't exist module-standardiser#61
• FIX Add gha- prefix to name of gha repo module-standardiser#62
• FIX Add missing 'shell' property to action gha-add-pr-to-project#4
• FIX Use inputs for variables and secrets gha-add-pr-to-project#5
• FIX Use inputs for new action module-standardiser#63
• Fix various problems (multiple commits) module-standardiser#64
• DOC Document new community contributions project on GitHub developer-docs#534
• FIX Use pull_request_target so we have access to secrets module-standardiser#65
• DOC Update README to have nicer names gha-add-pr-to-project#8

Module Standardiser PRs

Running against default-branch

• MNT Run module-standardiser recipe-kitchen-sink#64
• MNT Run module-standardiser gha-add-pr-to-project#2
• MNT Run module-standardiser recipe-testing#20
• MNT Run module-standardiser silverstripe-behat-extension#275
• MNT Run module-standardiser MinkFacebookWebDriver#28
• MNT Run module-standardiser cow#258
• MNT Run module-standardiser rhino#30
• MNT Run module-standardiser github-issue-search-client#138
• MNT Run module-standardiser module-standardiser#60
• MNT Run module-standardiser silverstripe-tx-translator#32
• MNT Run module-standardiser documentation-lint#5
• MNT Run module-standardiser supported-modules#36
• MNT Run module-standardiser #274
• MNT Run module-standardiser api.silverstripe.org#119
• MNT Run module-standardiser doc.silverstripe.org#300
• MNT Run module-standardiser silverstripe-userhelp-content#183
• MNT Run module-standardiser demo.silverstripe.org#69
• MNT Run module-standardiser silverstripe-frameworktest#186
• MNT Run module-standardiser silverstripe-module#44

Running against the CMS 5 next-patch branch

I've limited this to only run the new script (with exception of the new repo which had all scripts run). This is because the last few times standardiser was run it was against the next-minor branch, and running all those scripts here would result in redundant changes to check - some of which when I tried it did result in failures.

• MNT Run module-standardiser gha-add-pr-to-project#6
• MNT Run module-standardiser silverstripe-cms#2966
• MNT Run module-standardiser silverstripe-cms#2972
• MNT Run module-standardiser cwp-agencyextensions#126
• MNT Run module-standardiser cwp-starter-theme#257
• MNT Run module-standardiser cwp-watea-theme#192
• MNT Run module-standardiser silverstripe-elemental#1208
• MNT Run module-standardiser silverstripe-admin#1785
• MNT Run module-standardiser silverstripe-asset-admin#1472
• MNT Run module-standardiser silverstripe-assets#617
• MNT Run module-standardiser silverstripe-auditor#84
• MNT Run module-standardiser silverstripe-blog#767
• MNT Run module-standardiser silverstripe-campaign-admin#313
• MNT Run module-standardiser silverstripe-config#118
• MNT Run module-standardiser silverstripe-contentreview#241
• MNT Run module-standardiser silverstripe-documentconverter#86
• MNT Run module-standardiser silverstripe-elemental-bannerblock#152
• MNT Run module-standardiser silverstripe-elemental-fileblock#57
• MNT Run module-standardiser silverstripe-environmentcheck#107
• MNT Run module-standardiser silverstripe-errorpage#113
• MNT Run module-standardiser silverstripe-externallinks#133
• MNT Run module-standardiser silverstripe-framework#11283
• MNT Run module-standardiser silverstripe-graphql#594
• MNT Run module-standardiser silverstripe-gridfieldqueuedexport#113
• MNT Run module-standardiser silverstripe-hybridsessions#109
• MNT Run module-standardiser silverstripe-iframe#90
• MNT Run module-standardiser silverstripe-ldap#83
• MNT Run module-standardiser silverstripe-linkfield#299
• MNT Run module-standardiser silverstripe-lumberjack#156
• MNT Run module-standardiser silverstripe-mimevalidator#80
• MNT Run module-standardiser silverstripe-realme#148
• MNT Run module-standardiser silverstripe-session-manager#203
• MNT Run module-standardiser silverstripe-registry#101
• MNT Run module-standardiser silverstripe-reports#187
• MNT Run module-standardiser silverstripe-restfulserver#130
• MNT Run module-standardiser silverstripe-securityreport#84
• MNT Run module-standardiser silverstripe-segment-field#115
• MNT Run module-standardiser silverstripe-sharedraftcontent#243
• MNT Run module-standardiser silverstripe-siteconfig#169
• MNT Run module-standardiser silverstripe-sitewidecontent-report#96
• MNT Run module-standardiser silverstripe-spamprotection#121
• MNT Run module-standardiser silverstripe-staticpublishqueue#195
• MNT Run module-standardiser silverstripe-subsites#579
• MNT Run module-standardiser silverstripe-tagfield#296
• MNT Run module-standardiser silverstripe-taxonomy#118
• MNT Run module-standardiser silverstripe-textextraction#98
• MNT Run module-standardiser silverstripe-userforms#1306
• MNT Run module-standardiser silverstripe-versioned#453
• MNT Run module-standardiser silverstripe-versioned-admin#349
• MNT Run module-standardiser silverstripe-versionfeed#114
• MNT Run module-standardiser silverstripe-simple#85
• MNT Run module-standardiser silverstripe-mfa#550
• MNT Run module-standardiser silverstripe-totp-authenticator#165
• MNT Run module-standardiser silverstripe-webauthn-authenticator#188
• MNT Run module-standardiser silverstripe-login-forms#186
• MNT Run module-standardiser silverstripe-dynamodb#67
• MNT Run module-standardiser developer-docs#533

After merging

Reassign to Guy to

1. Make a docs PR for this whole thing
2. run standardiser against the next-patch branch again
3. Add all pre-existing community PRs to the board

[GuySartorelli]

I was intending on using a GitHub action to add PRs to the board as soon as they're opened.

https://docs.github.com/en/issues/planning-and-tracking-with-projects/automating-your-project/automating-projects-using-actions

GITHUB_TOKEN is scoped to the repository level and cannot access projects. To access projects you can either create a GitHub App (recommended for organization projects) or a personal access token (recommended for user projects). Workflow examples for both approaches are shown below.

That means storing a private key as a secret in the GitHub org - though it only needs write permissions for projects (not for issues/PRs/code) so not the worst case scenario.

Alternatives

1. Use project workflows to do it - there's a feature out of the box we can use, but it requires creating a separate "workflow" (not the same as GitHub Actions workflows) for each repo we want for the project. The process is documented at https://docs.github.com/en/issues/planning-and-tracking-with-projects/automating-your-project/adding-items-automatically BUT note we're only allowed 1 for free, and even if we paid money we only get up to 20. So not really viable for us.
2. Host a bot externally and use the GraphQL API as per documentation for that use case. We still need a token with the same level of access as the initial approach though, so it's not really any better. We either risk leaking a secret from within GitHub Actions or from our own hand-crafted tool and whatever service it's hosted on.