fix(closure-router): add GH_TOKEN to closing-PR lookup so issues mirror their closing PR's Status

[LukasWodka]

Summary

Fixes the org-wide kanban misroute where an issue closed by a merged PR lands on Prod instead of mirroring its closing PR's Status. Full evidence and analysis: tracebloc/backend#1195.

The "Determine target Status" step resolves the closing PR's base branch via gh api graphql, but had no GH_TOKEN in its env (only the "Update Status" step had one). On Actions runners gh exits immediately without a token, the error was discarded (2>/dev/null), the exit code swallowed (|| CLOSING_PR_BASE=""), and the empty base fell into the *) status=Prod arm — the default meant for manually completed issues. Deterministic for every issue closed as completed, in every repo calling this reusable workflow.

Observed twice on 2026-07-23 in client-runtime: issue #200 (closed by PR #204, base develop) and issue #202 (closed by PR #205, base develop) — both routed to Prod by the issues-event router runs while the PR cards correctly went to "FR on dev".

Changes

• Add GH_TOKEN: ${{ secrets.PROJECTS_KANBAN_TOKEN }} to the "Determine target Status" step env — the same secret the "Update Status" step already uses; all callers pass secrets: inherit, so no caller changes are needed.
• Stop suppressing the lookup's stderr so future lookup failures are visible in the run log. The || CLOSING_PR_BASE="" fallback stays, so manually completed issues still default to Prod as designed.
• Log the resolved closing-PR base for auditability.

Verification

• Replayed the exact GraphQL lookup with a token for both observed cases: returns baseRefName=develop (PR chore: drop a committed .pyc, and ignore the class (backend#1602) #204 / PR release-train: staging -> main #205) — with the token present the router emits "FR on dev". No query change needed: merged closing PRs are returned without includeClosedPrs.
• Reproduced the failure mode: the same gh api graphql call with GITHUB_ACTIONS=true and no GH_TOKEN exits 4 with "gh: To use GitHub CLI in a GitHub Actions workflow, set the GH_TOKEN environment variable."
• yaml.safe_load passes on the edited workflow.

Deploy note

Callers pin this reusable workflow @main, so the fix only takes effect once promoted develop → main on the normal cadence. (develop was fast-forwarded from main to serve as the PR base — it was stale at the PR #55 merge.)

Refs tracebloc/backend#1195

🤖 Generated with Claude Code

---

Note

Low Risk
CI workflow-only change with no app runtime impact; uses an existing secret already passed to the same workflow’s update step.

Overview
Fixes org-wide kanban routing when an issue is closed as completed by a merged PR: those issues were always sent to Prod instead of matching the closing PR’s branch (e.g. FR on dev).

The Determine target Status step now sets GH_TOKEN from PROJECTS_KANBAN_TOKEN (same secret the update step already uses; callers already secrets: inherit). Without it, gh api graphql fails on Actions, the failure was hidden, and the script treated every completed issue like a manual close (Prod).

Stderr is no longer discarded on that lookup so failures show in logs, and the resolved closing-PR base is echoed for debugging. Manual completions still default to Prod when no closing PR is found.

^{Reviewed by Cursor Bugbot for commit 4a8a488. Bugbot is set up for automated code reviews on this repo. Configure here.}

[LukasWodka]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 4a8a488. Configure here.}

[LukasWodka]

Superseded by #67, which merged with both the GH_TOKEN fix and the Prod-default fix. Closing (→ Cancelled).