ci(auto-add-to-project): make reusable via workflow_call, pin action version (#4)

* ci(auto-add-to-project): make reusable via workflow_call, pin action version, lock down permissions

* ci(auto-add-to-project): make reusable via workflow_call, pin action version, lock down permissions

Author: lml2468

.github/workflows/auto-add-to-project.yml

@@ -1,16 +1,27 @@
+# Triggered directly on issues/PRs in this (.github) repo,
+# AND callable as a reusable workflow from any other repo in the org.
 name: Auto-add to Octo Board
 
 on:
+  # Direct trigger: covers events in the .github repo itself
   issues:
     types: [opened]
   pull_request_target:
     types: [opened]
+  # Reusable trigger: called from per-repo caller workflows
+  workflow_call:
+    secrets:
+      PROJECT_TOKEN:
+        required: true
+
+# GITHUB_TOKEN needs no permissions; PROJECT_TOKEN (PAT) is used instead
+permissions: {}
 
 jobs:
   add-to-project:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e  # v1.0.2
         with:
           project-url: https://github.com/orgs/Mininglamp-OSS/projects/2
           github-token: ${{ secrets.PROJECT_TOKEN }}