Bump senzing-factory/build-resources/.github/workflows/add-to-project.yaml from 3 to 4

[dependabot]

Bumps senzing-factory/build-resources/.github/workflows/add-to-project.yaml from 3 to 4.

Release notes

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project.yaml's releases.

4.0.0

What's Changed

• #260 make shared workflows generic, misc cleanup by @​kernelsam in senzing-factory/build-resources#261

Full Changelog: senzing-factory/build-resources@v3...4.0.0

3.0.31

What's Changed

• Bump super-linter/super-linter from 8.4.0 to 8.5.0 by @​dependabot[bot] in senzing-factory/build-resources#257
• if the PR's REFRESHED_AT matches main's value, it only passes if that… by @​kernelsam in senzing-factory/build-resources#259

Full Changelog: senzing-factory/build-resources@v3...3.0.31

3.0.30

What's Changed

• Bump super-linter/super-linter from 8.3.1 to 8.3.2 by @​dependabot[bot] in senzing-factory/build-resources#254
• Bump actions/download-artifact from 6 to 7 by @​dependabot[bot] in senzing-factory/build-resources#250
• Bump super-linter/super-linter from 8.3.2 to 8.4.0 by @​dependabot[bot] in senzing-factory/build-resources#255
• Bump actions/upload-artifact from 5 to 6 by @​dependabot[bot] in senzing-factory/build-resources#249
• Fix regex for filtering GitHub workflows by @​kernelsam in senzing-factory/build-resources#256

Full Changelog: senzing-factory/build-resources@v3...3.0.30

3.0.29

What's Changed

• Bump super-linter/super-linter from 8.3.0 to 8.3.1 by @​dependabot[bot] in senzing-factory/build-resources#252
• Remove validation for natural language in workflows by @​kernelsam in senzing-factory/build-resources#253

Full Changelog: senzing-factory/build-resources@v3...3.0.29

3.0.28

What's Changed

• Add Markdown formatting guidelines to PR template by @​kernelsam in senzing-factory/build-resources#244
• Enhance PR review instructions for local and GitHub by @​kernelsam in senzing-factory/build-resources#246
• 247 dockter 1 by @​docktermj in senzing-factory/build-resources#248

New Contributors

• @​docktermj made their first contribution in senzing-factory/build-resources#248

Full Changelog: senzing-factory/build-resources@v3...3.0.28

3.0.27

Full Changelog: senzing-factory/build-resources@v3...3.0.27

3.0.26

Full Changelog: senzing-factory/build-resources@v3...3.0.26

... (truncated)

Changelog

Sourced from senzing-factory/build-resources/.github/workflows/add-to-project.yaml's changelog.

Changelog

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, markdownlint, and this project adheres to Semantic Versioning.

[Unreleased]

• Thing 5
• Thing 4

[1.0.1] - yyyy-mm-dd

Added to 1.0.1

• Thing 3

Fixed in 1.0.1

• Thing 2

[1.0.0] - yyyy-mm-dd

Added to 1.0.0

• Thing 2
• Thing 1

Commits

• 52eb86b bump tags to v4, slack channel override, missing claude settings (#262)
• 08fb769 #260 make shared workflows generic, misc cleanup (#261)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

---

Resolves #260
Resolves #262
Resolves #261
Resolves senzing-factory/build-resources#261
Resolves senzing-factory/build-resources#257
Resolves senzing-factory/build-resources#259
Resolves senzing-factory/build-resources#254
Resolves senzing-factory/build-resources#250
Resolves senzing-factory/build-resources#255
Resolves senzing-factory/build-resources#249
Resolves senzing-factory/build-resources#256
Resolves senzing-factory/build-resources#252
Resolves senzing-factory/build-resources#253
Resolves senzing-factory/build-resources#244
Resolves senzing-factory/build-resources#246
Resolves senzing-factory/build-resources#248

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Code Quality

✅ Code follows style guide - The change is minimal and follows standard YAML formatting conventions. The indentation and structure align with GitHub Actions workflow standards.

✅ No commented-out code - No commented code present in the diff.

✅ Meaningful variable names - N/A - This is a version bump in a workflow file, no variable naming changes.

✅ DRY principle followed - N/A - Single line version change.

✅ Identify Defects - No defects identified. This is a straightforward version bump from v3 to v4 of the reusable workflow reference at .github/workflows/add-to-project-g2-python.yaml:17. The change follows proper semantic versioning convention for GitHub Actions workflow references.

✅ Project memory configuration - No ./.claude/CLAUDE.md file detected in the repository that would need consideration.

Testing

⚠️ Testing considerations - This workflow change cannot be directly unit tested. The version bump updates the reusable workflow reference, which should be validated by:

• Ensuring the v4 tag exists in the senzing-factory/build-resources repository
• Verifying the workflow runs successfully after merge
• Confirming no breaking changes exist between v3 and v4 of the reusable workflow

Recommendation: Review the changelog/release notes for senzing-factory/build-resources v4 to understand what changed from v3.

Documentation

✅ README updated if needed - N/A - This workflow infrastructure change doesn't require README updates.

✅ API docs updated - N/A - No API changes.

✅ Inline comments for complex logic - N/A - The change is self-explanatory.

❌ CHANGELOG.md updated - No CHANGELOG.md update detected in this diff. If the project maintains a CHANGELOG, this version bump should be documented.

✅ Markdown formatting - N/A - No markdown file changes in this diff.

Security

✅ No hardcoded credentials - No credentials present.

✅ Input validation implemented - N/A - Workflow configuration change only.

✅ Proper error handling - The reusable workflow should handle errors internally.

✅ No sensitive data in logs - No sensitive data introduced.

✅ No license files or AQAAAD strings - No license files or suspicious strings detected in the diff.

---

Summary

Overall Assessment: ✅ APPROVED with minor recommendations

This is a low-risk change that updates a reusable workflow reference from v3 to v4. The change is clean and follows best practices for GitHub Actions versioning.

Action Items:

1. Consider updating CHANGELOG.md if the project maintains one
2. Verify that senzing-factory/build-resources/.github/workflows/add-to-project.yaml@v4 exists and review its release notes for any breaking changes
3. Monitor the first workflow run after merge to ensure compatibility

---

Automated code review analyzing defects and coding standards

[github-actions]

🤖 Claude Code Review

Code Review Analysis

Code Quality

✅ Code follows style guide - This is a GitHub Actions workflow YAML file. The change is a simple version bump that follows YAML formatting standards and workflow best practices.

✅ No commented-out code - No commented code present.

✅ Meaningful variable names - All variables and parameters are clear and follow GitHub Actions conventions (project-number, org, SENZING_GITHUB_PROJECT_RW_TOKEN).

✅ DRY principle followed - The workflow uses a reusable workflow reference, which is the correct pattern for avoiding duplication.

✅ No defects identified - The change is a straightforward version bump from @v3 to @v4 of a reusable workflow (.github/workflows/add-to-project.yaml@v3 → @v4:14). This type of change carries minimal risk assuming the upstream workflow is properly versioned.

✅ Project memory consideration - No .claude/CLAUDE.md found in the diff or repository context that would affect this review.

Testing

⚠️ Testing considerations - For workflow changes:

• Cannot assess unit/integration tests as this is infrastructure code
• Testing should verify that:
  • The workflow still triggers correctly on intended events
  • Issues/PRs are added to the correct project
  • Permissions are properly scoped
• Recommendation: Monitor the first few workflow runs after merge to ensure the v4 workflow behaves as expected

Documentation

✅ CHANGELOG.md - For dependency/workflow version bumps like this, CHANGELOG updates are typically optional unless there are breaking changes or significant behavioral differences in v4.

⚠️ Version change documentation - Consider documenting:

• What changes exist between v3 and v4 of the upstream workflow
• Whether any configuration changes are needed
• File: Would be good to add a note to project documentation if v4 introduces notable changes

Security

✅ No hardcoded credentials - Credentials properly use GitHub secrets (secrets.SENZING_GITHUB_PROJECT_RW_TOKEN).

✅ Proper permissions - Workflow permissions are explicitly scoped (repository-projects: write).

✅ No sensitive data exposure - No sensitive data in logs or configuration.

✅ No license files - No .lic files or AQAAAD strings detected in this change.

✅ Upstream workflow trust - Pinning to a versioned tag (@v4) rather than a branch is good practice, though using commit SHA would be even more secure (e.g., @v4 → @<commit-sha>).

---

Summary

Overall Assessment: ✅ APPROVED

This is a low-risk maintenance change that upgrades a reusable workflow dependency. The change is clean and follows best practices.

Action Items:

1. Before merge: Review the changelog/release notes for senzing-factory/build-resources/.github/workflows/add-to-project.yaml@v4 to ensure no breaking changes
2. After merge: Monitor the first 1-2 workflow executions to confirm expected behavior
3. Optional security hardening: Consider pinning to the specific commit SHA instead of the tag for supply chain security

No blocking issues found.

Automated code review analyzing defects and coding standards