chore(ci): use GITHUB_TOKEN for release-please

.github/workflows/release-please.yml

@@ -25,6 +25,8 @@ jobs:
     if: github.event_name == 'workflow_dispatch' || github.event.workflow_run.conclusion == 'success'
     outputs:
       releases_created: ${{ steps.release.outputs.releases_created }}
+      release_pr_number: ${{ steps.release-pr.outputs.number }}
+      release_pr_node_id: ${{ steps.release-pr.outputs.node_id }}
       backend_release_created: ${{ steps.release.outputs['apps/backend--release_created'] }}
       backend_tag_name: ${{ steps.release.outputs['apps/backend--tag_name'] }}
       backend_version: ${{ steps.release.outputs['apps/backend--version'] }}
@@ -37,9 +39,57 @@ jobs:
       - uses: googleapis/release-please-action@v4
         id: release
         with:
-          token: ${{ secrets.FILOZZY_CREATE_PR }}
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
+      - name: Resolve release PR node ID
+        id: release-pr
+        if: always()
+        uses: actions/github-script@v7
+        env:
+          PRS_CREATED: ${{ steps.release.outputs.prs_created }}
+          RELEASE_PRS: ${{ steps.release.outputs.prs }}
+          RELEASE_PR: ${{ steps.release.outputs.pr }}
+        with:
+          script: |
+            const owner = context.repo.owner;
+            const repo = context.repo.repo;
+            if (process.env.PRS_CREATED !== "true") {
+              core.info("No release PR created or updated in this run.");
+              return;
+            }
+            let pr = null;
+            if (process.env.RELEASE_PR) {
+              try {
+                pr = JSON.parse(process.env.RELEASE_PR);
+              } catch (error) {
+                core.info(`Failed to parse release-please pr output: ${error}`);
+              }
+            }
+            if (!pr && process.env.RELEASE_PRS) {
+              try {
+                const prs = JSON.parse(process.env.RELEASE_PRS);
+                pr = prs[0];
+              } catch (error) {
+                core.info(`Failed to parse release-please prs output: ${error}`);
+              }
+            }
+            if (!pr?.number) {
+              core.info("Release PR number not found in release-please outputs.");
+              return;
+            }
+            const prNumber = pr.number;
+            const { data } = await github.rest.pulls.get({
+              owner,
+              repo,
+              pull_number: prNumber
+            });
+            if (data.state !== "open") {
+              core.info(`Release PR #${prNumber} is ${data.state}; skipping add-to-project.`);
+              return;
+            }
+            core.info(`Release PR #${prNumber} is open; will add to project.`);
+            core.setOutput("node_id", data.node_id);
+            core.setOutput("number", String(prNumber));
 
   retag-backend:
     needs: release-please
@@ -100,3 +150,23 @@ jobs:
             "${REPO}:sha-${SOURCE_SHA}"
 
           echo "✅ Web released: v${VERSION}"
+
+  add-release-pr-to-project:
+    needs:
+      - release-please
+    if: |
+      always() &&
+      !cancelled() &&
+      needs.release-please.result == 'success' &&
+      needs.release-please.outputs.release_pr_node_id != ''
+    runs-on: ubuntu-latest
+    steps:
+      - name: Add release PR to project
+        # Use PAT here: fine-grained PATs don't support GitHub Releases, so release-please uses GITHUB_TOKEN.
+        # This is a non-PR-triggered workflow, so we must pass content-id explicitly instead of reusing the shared workflow.
+        if: needs.release-please.outputs.release_pr_node_id != ''
+        uses: actions/add-to-project@v1.0.2
+        with:
+          project-url: https://github.com/orgs/FilOzone/projects/14
+          github-token: ${{ secrets.FILOZZY_CI_ADD_TO_PROJECT }}
+          content-id: ${{ needs.release-please.outputs.release_pr_node_id }}