feat: add project sync workflow scaffolding for GitHub Projects integration by mohityadav8 · Pull Request #2356 · hiero-ledger/hiero-sdk-python

mohityadav8 · 2026-06-11T18:41:33Z

Description:

Add initial scaffolding for GitHub Project field synchronization automation.

Add project-sync module structure under scripts/project-sync
Add helper modules for GraphQL, label mapping, and linked issue handling
Add test file structure for project-sync
Add workflow placeholders for compute, apply, and test phases
Establish foundation for GitHub Projects V2 field synchronization described in Issue {ISSUE IN DRAFT} : Automated PR Review Queue via GitHub Projects #2288

Related issue(s):

Notes for reviewer:

This PR introduces the project structure and workflow scaffolding required for implementing automated GitHub Project field synchronization.

The implementation will follow the existing two-phase workflow pattern used by sync-issue-labels and will be expanded in subsequent commits.

Checklist

Documented (Code comments, README, etc.)
Tested (unit, integration, etc.)

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

coderabbitai · 2026-06-11T18:49:05Z

Warning

Review limit reached

@mohityadav8, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 58 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 60568b2c-b32b-4437-9c08-d4a21cd3cd16

📥 Commits

Reviewing files that changed from the base of the PR and between ef365d3 and cdf7617.

📒 Files selected for processing (4)

.github/workflows/sync-project-fields-apply.yml
.github/workflows/sync-project-fields-compute.yml
.github/workflows/test-project-sync.yml
scripts/project-sync/helpers/graphql.js

Walkthrough

This PR implements complete GitHub Actions automation to sync PR metadata into a GitHub Project V2 board. It adds two orchestrated workflows (compute and apply), five helper modules for label/GraphQL/data operations, a main entrypoint, and comprehensive unit tests—all configured via environment variables and designed to be idempotent and race-condition tolerant.

Changes

PR Project Field Synchronization

Layer / File(s)	Summary
Workflow Orchestration `.github/workflows/sync-project-fields-compute.yml`, `.github/workflows/sync-project-fields-apply.yml`, `.github/workflows/test-project-sync.yml`	Two paired workflows coordinate PR metadata sync: `compute` runs on PR events to extract priority/type from linked issues and store an artifact; `apply` runs on compute completion to update the project board. A third workflow runs tests when project-sync code changes.
Configuration & Environment Constants `scripts/project-sync/helpers/constants.js`	Central configuration defines GitHub API rate-limit floor, Project board and field node IDs from environment variables, and configurable label definitions (`PRIORITY_LABELS`, `TYPE_LABELS`) with derived lowercase lookup sets for membership testing.
GitHub API Helpers `scripts/project-sync/helpers/graphql.js`, `scripts/project-sync/helpers/labels.js`	GraphQL mutation/query helpers manage Project V2 operations (add PR item, update single-select fields, fetch field metadata). Label helpers idempotently ensure managed labels exist in the repository, tolerating 422 race-condition errors.
Data Extraction & Field Mapping `scripts/project-sync/helpers/linked-issues.js`, `scripts/project-sync/helpers/mapping.js`	Extract linked issues from PR body via regex parsing and closing keywords (`fixes`, `closes`, `resolves`), fetch issue labels, and map matching priority/type labels to single-select field values using precedence-ordered matching.
Main Orchestration & Package Setup `scripts/project-sync/helpers/index.js`, `scripts/project-sync/index.js`, `scripts/project-sync/package.json`	Main module exports a handler that orchestrates label initialization, project field metadata fetching, and per-PR synchronization (add to board, update field values). Helper exports wire all submodules. Package manifest defines test script entry points.
Test Infrastructure & Unit Tests `scripts/project-sync/tests/test-utils.js`, `scripts/project-sync/tests/test-graphql.js`, `scripts/project-sync/tests/test-labels.js`, `scripts/project-sync/tests/test-linked-issues.js`, `scripts/project-sync/tests/test-mapping.js`	Shared test harness provides mock GitHub client, test runner, and suite registration utilities. Four unit test suites exercise GraphQL operations, label idempotency, linked-issue parsing and deduplication, and field value precedence with full mocked API coverage.

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 71.43% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: adding project sync workflow scaffolding for GitHub Projects integration, which directly corresponds to the primary focus of all changes in the PR.
Description check	✅ Passed	The description is directly related to the changeset, explaining the module structure, helper modules, test files, and workflow scaffolding being added for GitHub Projects field synchronization as described in Issue `#2288`.
Linked Issues check	✅ Passed	The PR establishes the foundation for Issue `#2288`'s objectives by implementing the base module structure, helper functions for label mapping and linked-issue handling, and workflow scaffolding needed for automated label syncing from linked issues to Project board fields.
Out of Scope Changes check	✅ Passed	All changes are directly scoped to establishing the project-sync module structure, helpers, tests, and workflow placeholders required by Issue `#2288`. No unrelated changes are present.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

📋 Issue Planner

Built with CodeRabbit's Coding Plans for faster development and fewer bugs.

View plan used: #2288

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 10

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 501e8ddb-432a-45f4-9dfa-65cd426dd46d

📥 Commits

Reviewing files that changed from the base of the PR and between b399b2a and 5a7c71f.

📒 Files selected for processing (16)

.github/workflows/sync-project-fields-apply.yml
.github/workflows/sync-project-fields-compute.yml
.github/workflows/test-project-sync.yml
scripts/project-sync/helpers/constants.js
scripts/project-sync/helpers/graphql.js
scripts/project-sync/helpers/index.js
scripts/project-sync/helpers/labels.js
scripts/project-sync/helpers/linked-issues.js
scripts/project-sync/helpers/mapping.js
scripts/project-sync/index.js
scripts/project-sync/package.json
scripts/project-sync/tests/test-graphql.js
scripts/project-sync/tests/test-labels.js
scripts/project-sync/tests/test-linked-issues.js
scripts/project-sync/tests/test-mapping.js
scripts/project-sync/tests/test-utils.js

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

mohityadav8 · 2026-06-11T18:53:07Z

Hi @leninmehedy and @nadineloepfe,
The PR is now ready for review and all required checks are passing. I'd appreciate your feedback when you get a chance.
Thanks!

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

darshit2308

Great work on this one @mohityadav8 ! The foundational architecture for handling GitHub Projects V2 via the GraphQL API is really solid, and splitting this into a two-phase compute/apply workflow is definitely the right approach for security.

However, I've requested a few blocking changes that need to be addressed before we can merge this in:

Critical Blockers (P1):

Path Mismatches: Workflows are attempting to require and checkout from .github/scripts/project-sync/, but the module is located at scripts/project-sync/.
Security Boundary: The privileged apply workflow currently trusts the unvalidated JSON artifact generated by the untrusted PR branch code in the compute phase.

Important Fixes (P2):

The apply job is missing the issues: write permission required for the ensureAllLabels() function.
The concurrency group in the apply workflow uses a globally unique run ID, defeating its ability to prevent race conditions on the same PR.
The test workflow's trigger paths watch a non-existent directory.

I've left inline comments detailing these along with a minor regex robustness suggestion. Let me know if you want to discuss the best way to tackle the artifact validation security boundary!

github-actions · 2026-06-17T11:32:58Z

Hello, this is the OfficeHourBot.

This is a reminder that the Hiero Python SDK Office Hours will begin in approximately 2 hours and 28 minutes (14:00 UTC).

This session provides an opportunity to ask questions regarding this Pull Request.

Details:

Time: 14:00 UTC
Join Link: Zoom Meeting

Disclaimer: This is an automated reminder. Please verify the schedule here for any changes.

From,
The Python SDK Team

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

coderabbitai

Actionable comments posted: 5

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: a6bbf3b2-69e0-4473-a388-986fb6752408

📥 Commits

Reviewing files that changed from the base of the PR and between 5a7c71f and ef365d3.

📒 Files selected for processing (16)

.github/workflows/sync-project-fields-apply.yml
.github/workflows/sync-project-fields-compute.yml
.github/workflows/test-project-sync.yml
scripts/project-sync/helpers/constants.js
scripts/project-sync/helpers/graphql.js
scripts/project-sync/helpers/index.js
scripts/project-sync/helpers/labels.js
scripts/project-sync/helpers/linked-issues.js
scripts/project-sync/helpers/mapping.js
scripts/project-sync/index.js
scripts/project-sync/package.json
scripts/project-sync/tests/test-graphql.js
scripts/project-sync/tests/test-labels.js
scripts/project-sync/tests/test-linked-issues.js
scripts/project-sync/tests/test-mapping.js
scripts/project-sync/tests/test-utils.js

parvninama

@mohityadav8 Thanks for the contribution! I agree with several of the CodeRabbit comments, particularly the ones pointing out the syntax and permission issues. I believe those should be addressed before this is ready to merge

github-actions · 2026-06-28T11:35:36Z

Hi @mohityadav8,

This pull request has had no commit activity for 10 days. Are you still working on it?
To keep the PR active, you can:

Push a new commit.
Comment /working on the linked issue (not this PR).

If you're no longer working on this, please comment /unassign on the linked issue to release it for others. Otherwise, this PR may be closed due to inactivity.

Reach out on discord or join our office hours if you need assistance.

From the Python SDK Team

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

mohityadav8 · 2026-06-30T21:12:11Z

@parvninama All blocking and major issues have been addressed:

Fixed function names in graphql.js (addItemToProject, fetchProjectFields)
Completed apply script with syncPR call
Fixed concurrency block placement in test workflow
Removed redundant pulls.get call from compute workflow
Security boundary: apply re-fetches labels server-side

aceppaluni · 2026-07-01T15:25:39Z

Hi @mohityadav8!

Thank you so much for your work on this issue. We truly appreciate your contribution!!

As of now, the GH UI does not support triple sorting. At the moment, the most we are able to get is two. Therefore we will need to adjust how we go about sorting.

Additionally, upon discussion in today's Python meeting, the team has elected to have further conversation regarding the priority and scope of this issue and PR. Therefore, as of now I will be converting this to draft.

Once discussion has been finalized, we will reach out and let you know when this can be reviewed again. In the meantime, please feel free to work on other issues.

Thank you,

Python SDK Team

exploreriii

@mohityadav8 thank you for having a good go at this PR. You have made many good decisions, I expect you have found it useful as a learning process too. I think as the PR stands, it is not currently conforming to the repo structure and has some security questions so we would be unable to merge.

Additionally, I notice the issue you are solving here is marked as in draft - I assume we have not agreed on what the implementation should be. I would suggest we can discuss details here or in the issue body, or in a community call, to see if we can agree on what the review process should look like to avoid wasted effort

I notice some new labels are being proposed here e.g. priority: urgent, bug, and feature, none of which currently exist, which also need to be ratified against our current labels priority: critical/high/medium/low and also github native priority labels that have recently been added as a feature.

Further, the existing sync-issue-labels automation already copies linked-issue labels onto PRs, which we can already filter in the pull request tab.

Overall, there needs to be a fair bit of revamping in order to get this safe but also to ensure it is useful for the repo. Apologies, we now lock issues when they are proposed to avoid developers attempting them before they are 'approved'. Happy to hear any suggestions, and also if you believe we should archive the issue.

Thank you again

exploreriii · 2026-07-10T09:18:28Z

+jobs:
+  apply:
+    if: github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest


should be custom runner

exploreriii · 2026-07-10T09:20:15Z

+          script: |
+            const fs = require('fs');
+
+            if (!fs.existsSync('project-sync-payload.json')) {


Here you are downloading and requiring the project sync payload, plus attempting to give it high token permissions, from the artifact, are you sure the project sync payload is safe?

exploreriii · 2026-07-10T09:21:07Z

+
+      - name: Download Artifact
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        continue-on-error: true


if they can submit a project sync payload of arbitrary content and paths, we have a problem

exploreriii · 2026-07-10T09:21:52Z

+
+            const { prNumber, prNodeId } = payload;
+
+            if (!prNumber || !prNodeId) {


these fields could also in theory be corrupted

exploreriii · 2026-07-10T09:23:09Z

+      - name: Apply Project Field Values
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        env:
+          PROJECT_NODE_ID: ${{ secrets.PROJECT_NODE_ID }}


is this a secret?

exploreriii · 2026-07-10T09:23:56Z

@@ -0,0 +1,176 @@
+// SPDX-License-Identifier: Apache-2.0


Jest tests under tests/jest/ run by test-scripts.yml

exploreriii · 2026-07-10T09:24:18Z

@@ -0,0 +1,107 @@
+name: Sync PR Project Fields - Apply


CI automation in this repo lives in .github/scripts/ not /scripts

exploreriii · 2026-07-10T09:25:29Z

+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
+        with:
+          script: |
+            const prNumber = context.payload.pull_request.number;


not checking these are faithful

exploreriii · 2026-07-10T09:28:01Z

+            const prNodeId = context.payload.pull_request.node_id;
+            console.log(`--- Processing PR #${prNumber} (node: ${prNodeId}) ---`);
+
+            const prAuthor = context.payload.pull_request.user.login;


The compute workflow triggers on the PR author's copy of it

Upload-artifact preserves relative paths, so the artifact can contain scripts/project-sync/index.js or etc

github-actions · 2026-07-20T12:48:45Z

Hi @mohityadav8,

This pull request has had no activity for 10 days. Are you still working on it?
To keep the PR active, you can:

Push a new commit.
Comment /working on the linked issue (not this PR).

If you're no longer working on this, please comment /unassign on the linked issue to release it for others. Otherwise, this PR may be closed due to inactivity.

Reach out on discord or join our office hours if you need assistance.

From the Python SDK Team

mohityadav8 requested review from a team as code owners June 11, 2026 18:41

mohityadav8 requested review from leninmehedy and nadineloepfe June 11, 2026 18:41

github-actions Bot assigned nadineloepfe and leninmehedy Jun 11, 2026

feat: add project sync scaffolding

a6fba3b

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

mohityadav8 force-pushed the feat/project-sync branch from 5a7c71f to a6fba3b Compare June 11, 2026 18:47

Merge branch 'main' into feat/project-sync

9c27f7d

coderabbitai Bot reviewed Jun 11, 2026

View reviewed changes

Update .github/workflows/sync-project-fields-apply.yml

abeb977

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

Update index.js

31995e2

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

github-actions Bot added open to community review PR is open for community review and feedback queue:junior-committer PR awaiting initial quality review labels Jun 11, 2026

darshit2308 suggested changes Jun 12, 2026

View reviewed changes

exploreriii requested a review from parvninama June 17, 2026 13:00

mohityadav8 added 2 commits June 17, 2026 21:50

feat: improve project sync workflow

ef365d3

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

Update sync-project-fields-apply.yml

1bae453

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

coderabbitai Bot reviewed Jun 17, 2026

View reviewed changes

mohityadav8 requested a review from darshit2308 June 17, 2026 16:36

exploreriii requested review from manishdait and removed request for darshit2308 June 24, 2026 14:22

parvninama requested changes Jun 25, 2026

View reviewed changes

exploreriii marked this pull request as draft June 25, 2026 08:36

aceppaluni added Urgent Urgent review Low and removed Urgent Urgent review labels Jun 25, 2026

mohityadav8 added 4 commits July 1, 2026 02:26

fix: address parvninama and coderabbit review comments

5f36f82

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

fix: rename fetchProjectFields to addItemToProject in graphql.js

bf4d569

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

fix: move concurrency to top level in test workflow

7b75262

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

fix: correct function names in graphql.js and complete apply script

d645fe1

Signed-off-by: Mohit Yadav <ymohit799057@gmail.com>

mohityadav8 marked this pull request as ready for review June 30, 2026 21:12

Merge branch 'main' into feat/project-sync

cdf7617

mohityadav8 requested review from darshit2308 and parvninama June 30, 2026 21:13

aceppaluni marked this pull request as draft July 1, 2026 15:25

exploreriii requested changes Jul 10, 2026

View reviewed changes

exploreriii removed queue:junior-committer PR awaiting initial quality review open to community review PR is open for community review and feedback Low labels Jul 10, 2026

exploreriii unassigned leninmehedy and nadineloepfe Jul 10, 2026


		const { prNumber, prNodeId } = payload;

		if (!prNumber \|\| !prNodeId) {

Uh oh!

Conversation

mohityadav8 commented Jun 11, 2026

Uh oh!

coderabbitai Bot commented Jun 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Estimated code review effort

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mohityadav8 commented Jun 11, 2026

Uh oh!

darshit2308 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Jun 17, 2026

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

parvninama left a comment

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jun 28, 2026

Uh oh!

mohityadav8 commented Jun 30, 2026

Uh oh!

aceppaluni commented Jul 1, 2026

Uh oh!

exploreriii left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Jul 20, 2026

Uh oh!

Reviewers

Assignees

coderabbitai Bot commented Jun 11, 2026 •

edited

Loading