ci: [SDK-4484] use GH_PUSH_TOKEN for project workflow

[fadi-george]

Description

One Line Summary

Switch the project automation workflow to authenticate with GH_PUSH_TOKEN instead of GH_PROJECTS_TOKEN.

Details

Motivation

The GH_PROJECTS_TOKEN secret is being retired in favor of the GH_PUSH_TOKEN org secret used across the SDK repos for adding issues/PRs to the SDK Cross-Platform Project board. This keeps the .NET SDK aligned with the other SDK repos.

Scope

Only affects .github/workflows/project.yml. No SDK source code, public API, or runtime behavior is changed.

Testing

Manual testing

Will be verified post-merge by opening an issue and confirming the workflow run successfully adds it to the SDK Cross-Platform Project board.

Affected code checklist

• Notifications
  • Display
  • Open
  • Push Processing
  • Confirm Deliveries
• Outcomes
• Sessions
• In-App Messaging
• REST API requests
• Public API changes

Checklist

Overview

• I have filled out all REQUIRED sections above
• PR does one thing
• Any Public API changes are explained in the PR details and conform to existing APIs

Testing

• I have included test coverage for these changes, or explained why they are not needed (CI-only change)
• All automated tests pass, or I explained why that is not possible
• I have personally tested this on my device, or explained why that is not possible (workflow change, validated post-merge)

Final pass

• Code is as readable as possible.
• I have reviewed this PR myself, ensuring it meets each checklist item

Made with Cursor

[claude]

LGTM — single-line CI token swap aligning with the org-wide secret rotation.

Extended reasoning...

Overview

The PR changes a single line in .github/workflows/project.yml, swapping the secret name used to authenticate the actions/add-to-project@v1.0.2 step from GH_PROJECTS_TOKEN to GH_PUSH_TOKEN. No SDK source, public API, or runtime behavior is touched.

Security risks

None of substance. Both values are GitHub Actions secrets resolved at runtime; the PR does not expose, log, or print the token. The new secret is the org-standard token already used by sibling SDK repos for the same workflow, so the change reduces token sprawl rather than introducing new exposure.

Level of scrutiny

Low. This is a mechanical CI configuration change with a clearly stated motivation (retirement of GH_PROJECTS_TOKEN), trivially reversible by reverting one line. Verification is appropriately deferred to post-merge by opening an issue and confirming the project board automation still works.

Other factors

No prior reviews on the timeline, no bugs reported by the bug hunting system, and the change matches the description exactly. Safe to shadow-approve.