ci: [SDK-4490] use GH_PUSH_TOKEN for project workflow

[fadi-george]

Description

One Line Summary

Switch the project automation workflow to authenticate with GH_PUSH_TOKEN instead of GH_PROJECTS_TOKEN.

Details

Motivation

The GH_PROJECTS_TOKEN secret is being retired in favor of the GH_PUSH_TOKEN org secret used across the SDK repos for adding issues/PRs to the SDK Cross-Platform Project board. This keeps the Capacitor SDK aligned with the other SDK repos.

Scope

Only affects .github/workflows/project.yml. No SDK source code, public API, or runtime behavior is changed.

Testing

Manual testing

Will be verified post-merge by opening an issue and confirming the workflow run successfully adds it to the SDK Cross-Platform Project board.

Affected code checklist

• Notifications
  • Display
  • Open
  • Push Processing
  • Confirm Deliveries
• Outcomes
• Sessions
• In-App Messaging
• REST API requests
• Public API changes

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed (CI-only change)
• All automated tests pass, or I explained why that is not possible
• I have personally tested this on my device, or explained why that is not possible (workflow change, validated post-merge)

Final pass

• Code is as readable as possible.
• I have reviewed this PR myself, ensuring it meets each checklist item

Made with Cursor

[claude]

LGTM, simple secret swap in a CI workflow.

Extended reasoning...

Overview

This PR changes a single line in .github/workflows/project.yml, swapping the secret name from GH_PROJECTS_TOKEN to GH_PUSH_TOKEN for the actions/add-to-project step. No SDK source code, runtime behavior, or public API is touched.

Security risks

None. The change does not alter what permissions are granted; it only selects which org secret is passed as the token to a pinned third-party action (actions/add-to-project@v1.0.2). The token itself is managed at the org level.

Level of scrutiny

Minimal. This is a mechanical CI config change of a single line, motivated by org-wide secret consolidation across SDK repos. It is trivially reversible and easy to verify post-merge by opening an issue.

Other factors

The workflow only triggers on issues: opened, so any failure mode is contained and observable. No outstanding reviewer comments or prior bot reviews on this PR.