[FEATURE] Add scheduled project status sync workflow

[John McCall (lowlydba)]

Closes OvertureMaps/tf-data-platform#4632

Adds a sync-project-status composite action plus a thin scheduled workflow (every 3 hours, plus manual dispatch with a dry_run input) that keeps the Status field in sync for issues belonging to multiple org projects. Currently wired to Overture (#84), places-surge (#78), and CloudDevOps (#54).

• For each issue in 2+ projects with mismatched statuses, the most recently updated Status wins (updatedAt on the field value) and is copied to the others
• Option names are matched case-insensitively, so "In Progress" vs "In progress" is treated as already in sync; a genuinely missing option is logged as a warning and skipped
• Archived items and issues with no status set anywhere are ignored; a status set in only one project propagates to the unset side

The action splits into discrete modules: src/plan.js is pure planning logic with no IO, src/projects.js holds the GraphQL queries and mutation, src/index.js orchestrates. See the action README for behavior and conflict resolution details.

CloudDevOps' Status options didn't match the standard set (Backlog, Todo, In Progress, Blocked, In Review, Done, Icebin, Needs Information), so before wiring it in I reconciled the live project directly: renamed Todo → Ready, moved the 4 Needs Information items to Blocked and the 4 Icebin items to Backlog, then deleted those two options plus the unused In Review (0 items). It now matches Backlog, Ready, In Progress, Blocked, Done like the other two projects.

Setup

The default GITHUB_TOKEN can't touch org ProjectsV2, so the workflow authenticates as the overture-project-manager GitHub App. It assumes the narrow gha-project-manager-secrets-reader OIDC role and fetches the app PEM from Secrets Manager at runtime, same pattern as safe-settings-sync. The app, role, and secret are wired up in OvertureMaps/omf-github-terraform#91 (tracked by OvertureMaps/tf-data-platform#4658), which should merge and apply first. The client ID isn't sensitive and is hard-coded inline, like SAFE_SETTINGS_APP_ID.

Security

Ran a security review against the public-repo Actions threat model, no exploitable findings:

• Triggers are schedule + workflow_dispatch only, so no fork-PR secret exposure; the dispatch input is a typed boolean into a with: value
• No untrusted data flows into shell or script bodies; logged values (project titles, status option names) require org project write access to influence, and issue titles/bodies are never fetched
• App token blast radius is org Projects R/W plus Issues/PR read; worst case is shuffled project statuses
• The PEM is fetched from Secrets Manager via short-lived OIDC credentials rather than stored as a GitHub secret; the IAM role can only read secrets tagged project_manager
• Actions SHA-pinned, persist-credentials: false, sparse checkout, contents: read

Testing

Ran the action's modules locally against both live projects in dry-run mode (real fetchProject/buildPlan code, gh-backed GraphQL stub): 44 shared items, 3 real mismatches found, all with sensible winners (two Overture-side edits winning over stale places-surge values, one status propagating to an unset Overture item). The mutation path and the OIDC/Secrets Manager fetch haven't run yet; the first scheduled run after the terraform PR applies will exercise them. zizmor is clean on the workflow and action.

[Copilot]

Pull request overview

Adds a scheduled GitHub Actions workflow plus a new composite action (.github/actions/sync-project-status) to keep the Status field synchronized across multiple org-level ProjectsV2 for issues/PRs that appear in more than one project, using a “most recently updated wins” rule and supporting a dry-run mode.

Changes:

• Introduces a scheduled + manually-dispatchable workflow that assumes AWS OIDC credentials and retrieves a GitHub App PEM from AWS Secrets Manager before running the sync action.
• Adds a composite action implemented via actions/github-script, split into GraphQL IO (src/projects.js) and pure planning logic (src/plan.js).
• Documents behavior, setup requirements, and conflict resolution in an action README.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/sync-project-status.yml	New scheduled/dispatch workflow to run the sync action with AWS OIDC + Secrets Manager PEM fetch.
.github/actions/sync-project-status/action.yml	Composite action wiring: mask key, mint GitHub App token, execute sync via github-script.
.github/actions/sync-project-status/src/projects.js	GraphQL query/mutation layer for ProjectsV2 fetch + status updates.
.github/actions/sync-project-status/src/plan.js	Pure planning logic to compute which project items need status updates/skips.
.github/actions/sync-project-status/src/index.js	Orchestration: validate projects, log skipped items, apply or dry-run changes.
.github/actions/sync-project-status/README.md	Usage and behavior documentation for the action and its workflow integration.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Eric Godwin (ericgodwin)]

Copilot had a lot to say but I am good :)