feat: Allow automatic project actions on events (#30205)

This PR introduces project workflows, allowing users to configure
event-based automations directly from the UI.
Users can define filters and actions for each workflow event, and
duplicate existing events when needed.

### Concepts

Every workflow is composed of `event`, `filters`, and `actions`.

- **Event** - An Event defines when a workflow should be triggered. It
represents specific activities such as an issue being added to the
project, a pull request being merged, or a project column being changed.
- **Filter** - A Filter refines when an event should take effect. It
allows users to specify conditions like issue type, labels, or project
columns to ensure actions only run in targeted scenarios.
- **Action** - An Action defines what happens when the event and filters
match. It performs operations such as adding labels, moving issues
between columns, or changing the issue or pull request state.

### Available Events

Currently, the following eight events are supported:

- On issues/pull requests closed
- On issues/pull requests reopened
- On issues/pull requests was added to the project, including when
created in it
- On issues/pull requests was removed from the project
- On issues/pull requests' column was changed
- On code changes requested
- On code review approved
- On pull request merged

Each event type supports its own set of filters and actions.

### Available Filters

There are four types of filters that can be configured for an event:

- **Apply to** - Specify the target type: `issues only`, `pull requests
only`, or `issues and pull requests`.
- **Labels** - Trigger the event only if the issue or pull request
contains one or more specified labels.
- **Move from column** - Filter events based on the original project
column.
- **Move to column** - Filter events based on the destination project
column.

### Available Actions

There are four types of actions that can be executed when an event is
triggered:

- **Add labels** - Automatically add one or more labels to the issue or
pull request.
- **Remove labels** - Remove one or more specified labels.
- **Move to column** - Move the issue or pull request to a designated
project column.
- **Issue state** - Close or reopen the issue. Pull requests can only be
closed.

### Enable/Disable an event workflow

Each event workflow can be individually enabled or disabled. When
disabled, the workflow will be ignored even if the event occurs. This
feature is useful when you want to temporarily stop certain automated
actions without deleting the workflow configuration. Workflows of closed
projects don't run either.

### Clone an event workflow

When you need multiple workflows for the same event, you can clone an
existing event to create a new one with different filters and actions.
This allows you to customize how the same event behaves under different
conditions, making workflows more flexible and powerful.

### Permissions

Permissions are checked when workflows are managed, not when they run:

- Viewing a project's workflows needs read access to the project
- Managing them needs write access to the project plus write access to
both issues and pull requests of a repository project's repository,
being an owner of an organization project's organization or a site
administrator, or being the user of a user project. Tokens limited to
public repositories can't manage owner-level projects' workflows
- A workflow runs when its event happens to an item of an open project
that can hold the item's repository, unless that repository is archived,
no matter who caused the event, and applies its actions without further
permission checks. Pull requests are never reopened
- Changes show as made by "Project workflow" on behalf of the user who
triggered the event and don't trigger other workflows
- Only users who can read an item can put it on a board or move its card

The management rule is also documented on `CanManageWorkflows` in
`services/projects/workflow.go`.

Fixes:  #14359
Fixes: #26704
Fixes: #27990
Replaces:  #28745
Documentation PR: https://gitea.com/gitea/docs/pulls/308
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Giteabot <teabot@gitea.io>

services/projects/issue.go

@@ -14,6 +14,7 @@ import (
 	user_model "gitea.dev/models/user"
 	"gitea.dev/modules/optional"
 	"gitea.dev/modules/util"
+	notify_service "gitea.dev/services/notify"
 
 	"xorm.io/builder"
 )
@@ -25,134 +26,183 @@ var ErrIssueNotInProject = util.ErrorWrap(util.ErrUnprocessableContent, "all iss
 // AddIssueToColumn assigns the issue to the column's project if needed, then places it in
 // the column. One transaction, so a failure cannot strand it in the default column.
 func AddIssueToColumn(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, column *project_model.Column) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	var added []int64
+	moves, err := db.WithTx2(ctx, func(ctx context.Context) ([]columnMove, error) {
 		projectIDs, err := issue.ProjectIDs(ctx)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		if !slices.Contains(projectIDs, column.ProjectID) {
 			// lands in the default column, the move below puts it in the requested one
-			if err := issues_model.IssueAssignOrRemoveProject(ctx, issue, doer, append(projectIDs, column.ProjectID)); err != nil {
-				return err
+			if added, _, err = issues_model.IssueAssignOrRemoveProject(ctx, issue, doer, append(projectIDs, column.ProjectID)); err != nil {
+				return nil, err
 			}
 		}
-		return MoveIssueToColumn(ctx, doer, issue, column, optional.None[int64]())
+		return moveIssueToColumn(ctx, doer, issue, column, optional.None[int64]())
 	})
+	if err != nil {
+		return err
+	}
+	notify_service.IssueChangeProjects(ctx, doer, issue, added, nil)
+	notifyColumnMoves(ctx, doer, column, moves)
+	return nil
 }
 
 // MoveIssueToColumn places an issue already in the project into a column, appending it
 // when sorting is absent.
 func MoveIssueToColumn(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, column *project_model.Column, sorting optional.Option[int64]) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		position := sorting.Value()
-		if !sorting.Has() {
-			next, err := project_model.GetColumnIssueNextSorting(ctx, column)
-			if err != nil {
-				return err
-			}
-			position = next
-		}
-		return MoveIssuesOnProjectColumn(ctx, doer, column, map[int64]int64{position: issue.ID})
+	moves, err := db.WithTx2(ctx, func(ctx context.Context) ([]columnMove, error) {
+		return moveIssueToColumn(ctx, doer, issue, column, sorting)
 	})
+	if err != nil {
+		return err
+	}
+	notifyColumnMoves(ctx, doer, column, moves)
+	return nil
+}
+
+func moveIssueToColumn(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, column *project_model.Column, sorting optional.Option[int64]) ([]columnMove, error) {
+	position := sorting.Value()
+	if !sorting.Has() {
+		next, err := project_model.GetColumnIssueNextSorting(ctx, column)
+		if err != nil {
+			return nil, err
+		}
+		position = next
+	}
+	return moveIssuesOnProjectColumn(ctx, doer, column, map[int64]int64{position: issue.ID})
 }
 
 // RemoveIssueFromColumn detaches the issue from the column's project, reporting a
 // not-exist error when it is not in that column.
 func RemoveIssueFromColumn(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, column *project_model.Column) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
+	removed, err := db.WithTx2(ctx, func(ctx context.Context) ([]int64, error) {
 		exists, err := project_model.IsIssueInColumn(ctx, issue.ID, column)
 		if err != nil {
-			return err
+			return nil, err
 		}
 		if !exists {
-			return util.NewNotExistErrorf("issue %d is not in column %d", issue.ID, column.ID)
+			return nil, util.NewNotExistErrorf("issue %d is not in column %d", issue.ID, column.ID)
 		}
 		projectIDs, err := issue.ProjectIDs(ctx)
 		if err != nil {
-			return err
+			return nil, err
 		}
-		remaining := util.SliceRemoveAll(projectIDs, column.ProjectID)
-		return issues_model.IssueAssignOrRemoveProject(ctx, issue, doer, remaining)
+		_, removed, err := issues_model.IssueAssignOrRemoveProject(ctx, issue, doer, util.SliceRemoveAll(projectIDs, column.ProjectID))
+		return removed, err
 	})
+	if err != nil {
+		return err
+	}
+	notify_service.IssueChangeProjects(ctx, doer, issue, nil, removed)
+	return nil
 }
 
 // MoveIssuesOnProjectColumn moves or keeps issues in a column and sorts them inside that column
 func MoveIssuesOnProjectColumn(ctx context.Context, doer *user_model.User, column *project_model.Column, sortedIssueIDs map[int64]int64) error {
-	return db.WithTx(ctx, func(ctx context.Context) error {
-		issueIDs := make([]int64, 0, len(sortedIssueIDs))
-		for _, issueID := range sortedIssueIDs {
-			issueIDs = append(issueIDs, issueID)
+	moves, err := db.WithTx2(ctx, func(ctx context.Context) ([]columnMove, error) {
+		return moveIssuesOnProjectColumn(ctx, doer, column, sortedIssueIDs)
+	})
+	if err != nil {
+		return err
+	}
+	notifyColumnMoves(ctx, doer, column, moves)
+	return nil
+}
+
+type columnMove struct {
+	issue       *issues_model.Issue
+	oldColumnID int64
+}
+
+func notifyColumnMoves(ctx context.Context, doer *user_model.User, column *project_model.Column, moves []columnMove) {
+	for _, move := range moves {
+		notify_service.IssueChangeProjectColumn(ctx, doer, move.issue, move.oldColumnID, column)
+	}
+}
+
+func moveIssuesOnProjectColumn(ctx context.Context, doer *user_model.User, column *project_model.Column, sortedIssueIDs map[int64]int64) ([]columnMove, error) {
+	issueIDs := util.ValuesOfMap(sortedIssueIDs)
+	count, err := db.GetEngine(ctx).
+		Where("project_id=?", column.ProjectID).
+		In("issue_id", issueIDs).
+		Count(new(project_model.ProjectIssue))
+	if err != nil {
+		return nil, err
+	}
+	if int(count) != len(sortedIssueIDs) {
+		return nil, ErrIssueNotInProject
+	}
+
+	issues, err := issues_model.GetIssuesByIDs(ctx, issueIDs)
+	if err != nil {
+		return nil, err
+	}
+	if _, err := issues.LoadRepositories(ctx); err != nil {
+		return nil, err
+	}
+
+	project, err := project_model.GetProjectByID(ctx, column.ProjectID)
+	if err != nil {
+		return nil, err
+	}
+
+	issuesMap := make(map[int64]*issues_model.Issue, len(issues))
+	for _, issue := range issues {
+		issuesMap[issue.ID] = issue
+	}
+
+	var moves []columnMove
+	var defaultColumn *project_model.Column
+	for sorting, issueID := range sortedIssueIDs {
+		curIssue := issuesMap[issueID]
+		if curIssue == nil {
+			continue
 		}
-		count, err := db.GetEngine(ctx).
-			Where("project_id=?", column.ProjectID).
-			In("issue_id", issueIDs).
-			Count(new(project_model.ProjectIssue))
+
+		projectColumnMap, err := curIssue.ProjectColumnMap(ctx)
 		if err != nil {
-			return err
-		}
-		if int(count) != len(sortedIssueIDs) {
-			return ErrIssueNotInProject
+			return nil, err
 		}
 
-		issues, err := issues_model.GetIssuesByIDs(ctx, issueIDs)
-		if err != nil {
-			return err
-		}
-		if _, err := issues.LoadRepositories(ctx); err != nil {
-			return err
-		}
-
-		project, err := project_model.GetProjectByID(ctx, column.ProjectID)
-		if err != nil {
-			return err
-		}
-
-		issuesMap := make(map[int64]*issues_model.Issue, len(issues))
-		for _, issue := range issues {
-			issuesMap[issue.ID] = issue
-		}
-
-		for sorting, issueID := range sortedIssueIDs {
-			curIssue := issuesMap[issueID]
-			if curIssue == nil {
-				continue
-			}
-
-			projectColumnMap, err := curIssue.ProjectColumnMap(ctx)
-			if err != nil {
-				return err
-			}
-
-			projectColumnID := projectColumnMap[column.ProjectID]
-
-			if projectColumnID != column.ID {
-				// add timeline to issue
-				if _, err := issues_model.CreateComment(ctx, &issues_model.CreateCommentOptions{
-					Type:               issues_model.CommentTypeProjectColumn,
-					Doer:               doer,
-					Repo:               curIssue.Repo,
-					Issue:              curIssue,
-					ProjectID:          column.ProjectID,
-					ProjectTitle:       project.Title,
-					ProjectColumnID:    column.ID,
-					ProjectColumnTitle: column.Title,
-				}); err != nil {
-					return err
+		oldColumnID := projectColumnMap[column.ProjectID]
+		if oldColumnID == 0 { // legacy encoding of the default column
+			if defaultColumn == nil {
+				if defaultColumn, err = project.MustDefaultColumn(ctx); err != nil {
+					return nil, err
 				}
 			}
-
-			// Update the column and sorting for this specific issue in this specific project.
-			// IMPORTANT: The WHERE clause must include both issue_id AND project_id to ensure
-			// that moving an issue's column in one project doesn't affect its column in other
-			// projects when the issue is assigned to multiple projects.
-			_, err = db.Exec(ctx, "UPDATE `project_issue` SET project_board_id=?, sorting=? WHERE issue_id=? AND project_id=?",
-				column.ID, sorting, issueID, column.ProjectID)
-			if err != nil {
-				return err
-			}
+			oldColumnID = defaultColumn.ID
 		}
-		return nil
-	})
+
+		if oldColumnID != column.ID {
+			// add timeline to issue
+			if _, err := issues_model.CreateComment(ctx, &issues_model.CreateCommentOptions{
+				Type:               issues_model.CommentTypeProjectColumn,
+				Doer:               doer,
+				Repo:               curIssue.Repo,
+				Issue:              curIssue,
+				ProjectID:          column.ProjectID,
+				ProjectTitle:       project.Title,
+				ProjectColumnID:    column.ID,
+				ProjectColumnTitle: column.Title,
+			}); err != nil {
+				return nil, err
+			}
+			moves = append(moves, columnMove{issue: curIssue, oldColumnID: oldColumnID})
+		}
+
+		// Update the column and sorting for this specific issue in this specific project.
+		// IMPORTANT: The WHERE clause must include both issue_id AND project_id to ensure
+		// that moving an issue's column in one project doesn't affect its column in other
+		// projects when the issue is assigned to multiple projects.
+		_, err = db.Exec(ctx, "UPDATE `project_issue` SET project_board_id=?, sorting=? WHERE issue_id=? AND project_id=?",
+			column.ID, sorting, issueID, column.ProjectID)
+		if err != nil {
+			return nil, err
+		}
+	}
+	return moves, nil
 }
 
 func LoadIssuesAssigneesForProject(ctx context.Context, projectID int64) (users []*user_model.User, _ error) {

services/projects/issue_test.go

@@ -111,12 +111,12 @@ func Test_Projects(t *testing.T) {
 
 		// issue 6 belongs to private repo 3 under org 3
 		issue6 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 6})
-		err = issues_model.IssueAssignOrRemoveProject(t.Context(), issue6, user2, []int64{project1.ID})
+		_, _, err = issues_model.IssueAssignOrRemoveProject(t.Context(), issue6, user2, []int64{project1.ID})
 		assert.NoError(t, err)
 
 		// issue 16 belongs to public repo 16 under org 3
 		issue16 := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 16})
-		err = issues_model.IssueAssignOrRemoveProject(t.Context(), issue16, user2, []int64{project1.ID})
+		_, _, err = issues_model.IssueAssignOrRemoveProject(t.Context(), issue16, user2, []int64{project1.ID})
 		assert.NoError(t, err)
 
 		projects, err := db.Find[project_model.Project](t.Context(), project_model.SearchOptions{
@@ -189,7 +189,8 @@ func Test_Projects(t *testing.T) {
 			}()
 		}
 
-		assert.NoError(t, issues_model.IssueAssignOrRemoveProject(t.Context(), issue11, user2, []int64{projects[0].ID, projects[1].ID}))
+		_, _, err := issues_model.IssueAssignOrRemoveProject(t.Context(), issue11, user2, []int64{projects[0].ID, projects[1].ID})
+		assert.NoError(t, err)
 
 		// the column the issue must stay in for the second project
 		otherColumn, err := projects[1].MustDefaultColumn(t.Context())

services/projects/label.go

@@ -0,0 +1,34 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package project
+
+import (
+	"context"
+
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+)
+
+func GetProjectLabels(ctx context.Context, project *project_model.Project) ([]*issues_model.Label, error) {
+	if project.Type != project_model.TypeRepository {
+		labels, err := issues_model.GetLabelsByOrgID(ctx, project.OwnerID, "", db.ListOptionsAll)
+		issues_model.SortLabelsForDisplay(labels)
+		return labels, err
+	}
+	labels, err := issues_model.GetLabelsByRepoID(ctx, project.RepoID, "", db.ListOptionsAll)
+	if err != nil {
+		return nil, err
+	}
+	issues_model.SortLabelsForDisplay(labels)
+	if err := project.LoadRepo(ctx); err != nil {
+		return nil, err
+	}
+	orgLabels, err := issues_model.GetLabelsByOrgID(ctx, project.Repo.OwnerID, "", db.ListOptionsAll)
+	if err != nil {
+		return nil, err
+	}
+	issues_model.SortLabelsForDisplay(orgLabels)
+	return append(labels, orgLabels...), nil
+}

services/projects/main_test.go

@@ -7,11 +7,15 @@ import (
 	"testing"
 
 	"gitea.dev/models/unittest"
+	notify_service "gitea.dev/services/notify"
 
 	_ "gitea.dev/models/actions"
 	_ "gitea.dev/models/activities"
 )
 
+var labelChanges = &labelChangeRecorder{}
+
 func TestMain(m *testing.M) {
+	notify_service.RegisterNotifier(labelChanges)
 	unittest.MainTest(m)
 }

services/projects/workflow.go

@@ -0,0 +1,196 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package project
+
+import (
+	"context"
+	"slices"
+
+	audit_model "gitea.dev/models/audit"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	access_model "gitea.dev/models/perm/access"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/unit"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/util"
+	"gitea.dev/services/audit"
+)
+
+// CanManageWorkflows checks the authority needed besides project write to manage a project's workflows. They act on
+// the project's items without further permission checks, so this needs write access to both issues and pull requests
+// of a repository project's repository, owning an organization project's organization, or being a user project's user.
+func CanManageWorkflows(ctx context.Context, doer *user_model.User, project *project_model.Project) (bool, error) {
+	if project.Type == project_model.TypeRepository {
+		if err := project.LoadRepo(ctx); err != nil {
+			return false, err
+		}
+		perm, err := access_model.GetDoerRepoPermission(ctx, project.Repo, doer)
+		if err != nil {
+			return false, err
+		}
+		return perm.CanWrite(unit.TypeIssues) && perm.CanWrite(unit.TypePullRequests), nil
+	}
+	if !user_model.DoerCanViewPrivate(doer) { // owner-level projects hold items of the owner's private repositories too
+		return false, nil
+	}
+	if project.Type == project_model.TypeOrganization {
+		if user_model.DoerIsSiteAdminFullAccess(doer) {
+			return true, nil
+		}
+		return organization.IsOrganizationOwner(ctx, project.OwnerID, doer.ID)
+	}
+	return doer.ID == project.OwnerID, nil
+}
+
+func checkCanManageWorkflows(ctx context.Context, doer *user_model.User, project *project_model.Project) error {
+	allowed, err := CanManageWorkflows(ctx, doer, project)
+	if err != nil {
+		return err
+	}
+	if !allowed {
+		return util.NewPermissionDeniedErrorf("not allowed to manage the workflows of this project")
+	}
+	return nil
+}
+
+func CreateWorkflow(ctx context.Context, doer *user_model.User, project *project_model.Project, opts *api.CreateProjectWorkflowOption) (*project_model.Workflow, error) {
+	if err := checkCanManageWorkflows(ctx, doer, project); err != nil {
+		return nil, err
+	}
+	wf := &project_model.Workflow{
+		ProjectID:     project.ID,
+		WorkflowEvent: project_model.WorkflowEvent(opts.Event),
+		Enabled:       optional.FromPtr(opts.Enabled).ValueOrDefault(true),
+	}
+	if !wf.WorkflowEvent.IsValid() {
+		return nil, util.ErrorWrap(util.ErrUnprocessableContent, "invalid event: %s", opts.Event)
+	}
+	if err := setWorkflowRules(ctx, project, wf, &opts.Filters, &opts.Actions); err != nil {
+		return nil, err
+	}
+	if err := project_model.CreateWorkflow(ctx, wf); err != nil {
+		return nil, err
+	}
+	recordWorkflowAudit(ctx, doer, audit_model.ProjectWorkflowCreate, project, wf)
+	return wf, nil
+}
+
+func UpdateWorkflow(ctx context.Context, doer *user_model.User, project *project_model.Project, wf *project_model.Workflow, opts *api.EditProjectWorkflowOption) error {
+	if err := checkCanManageWorkflows(ctx, doer, project); err != nil {
+		return err
+	}
+	var cols []string
+	if opts.Filters != nil || opts.Actions != nil {
+		if err := setWorkflowRules(ctx, project, wf, opts.Filters, opts.Actions); err != nil {
+			return err
+		}
+	}
+	if opts.Filters != nil {
+		cols = append(cols, "workflow_filters")
+	}
+	if opts.Actions != nil {
+		cols = append(cols, "workflow_actions")
+	}
+	if opts.Enabled != nil {
+		wf.Enabled = *opts.Enabled
+		cols = append(cols, "enabled")
+	}
+	if len(cols) == 0 {
+		return nil
+	}
+	if err := project_model.UpdateWorkflow(ctx, wf, cols...); err != nil {
+		return err
+	}
+	recordWorkflowAudit(ctx, doer, audit_model.ProjectWorkflowUpdate, project, wf)
+	return nil
+}
+
+func DeleteWorkflow(ctx context.Context, doer *user_model.User, project *project_model.Project, wf *project_model.Workflow) error {
+	if err := checkCanManageWorkflows(ctx, doer, project); err != nil {
+		return err
+	}
+	if err := project_model.DeleteWorkflow(ctx, project.ID, wf.ID); err != nil {
+		return err
+	}
+	recordWorkflowAudit(ctx, doer, audit_model.ProjectWorkflowDelete, project, wf)
+	return nil
+}
+
+func recordWorkflowAudit(ctx context.Context, doer *user_model.User, action audit_model.Action, project *project_model.Project, wf *project_model.Workflow) {
+	var scope audit_model.EntityRef
+	if project.Type == project_model.TypeRepository {
+		if err := project.LoadRepo(ctx); err != nil {
+			log.Error("recordWorkflowAudit: LoadRepo: %v", err)
+			scope = audit_model.EntityRef{Type: audit_model.ScopeRepository, ID: project.RepoID}
+		} else {
+			scope = audit.ScopeFromRepository(project.Repo)
+		}
+	} else {
+		scope = audit.ScopeFromUserID(ctx, project.OwnerID)
+	}
+	audit.RecordAs(ctx, doer, action, scope, "project", project.Title, "project_id", project.ID, "workflow_id", wf.ID, "event", string(wf.WorkflowEvent))
+}
+
+func setWorkflowRules(ctx context.Context, project *project_model.Project, wf *project_model.Workflow, newFilters *api.ProjectWorkflowFilters, newActions *api.ProjectWorkflowActions) error {
+	if newFilters != nil {
+		wf.WorkflowFilters = project_model.WorkflowFilters(*newFilters)
+		wf.WorkflowFilters.LabelIDs = uniqueIDs(newFilters.LabelIDs)
+	}
+	if newActions != nil {
+		wf.WorkflowActions = project_model.WorkflowActions(*newActions)
+		wf.WorkflowActions.AddLabelIDs = uniqueIDs(newActions.AddLabelIDs)
+		wf.WorkflowActions.RemoveLabelIDs = uniqueIDs(newActions.RemoveLabelIDs)
+	}
+	filters, actions := wf.WorkflowFilters, wf.WorkflowActions
+
+	if typ := wf.UnsupportedRule(); typ != "" {
+		return util.ErrorWrap(util.ErrUnprocessableContent, "%s is not supported by this event", typ)
+	}
+	if len(actions.Types()) == 0 {
+		return util.ErrorWrapTranslatable(util.ErrorWrap(util.ErrUnprocessableContent, "at least one action must be configured"), "projects.workflows.at_least_one_action_required")
+	}
+	if !slices.Contains([]string{"", project_model.WorkflowIssueTypeIssue, project_model.WorkflowIssueTypePullRequest}, filters.IssueType) {
+		return util.ErrorWrap(util.ErrUnprocessableContent, "invalid issue_type: %s", filters.IssueType)
+	}
+	if !slices.Contains([]string{"", project_model.WorkflowIssueStateClose, project_model.WorkflowIssueStateReopen}, actions.IssueState) {
+		return util.ErrorWrap(util.ErrUnprocessableContent, "invalid issue_state: %s", actions.IssueState)
+	}
+	if actions.IssueState == project_model.WorkflowIssueStateReopen && filters.IssueType == project_model.WorkflowIssueTypePullRequest {
+		return util.ErrorWrap(util.ErrUnprocessableContent, "pull requests cannot be reopened by a workflow")
+	}
+
+	for _, columnID := range []int64{filters.SourceColumnID, filters.TargetColumnID, actions.ColumnID} {
+		if columnID == 0 {
+			continue
+		}
+		if _, err := project_model.GetColumnByIDAndProjectID(ctx, columnID, project.ID); project_model.IsErrProjectColumnNotExist(err) {
+			return util.ErrorWrap(util.ErrUnprocessableContent, "invalid column: %d", columnID)
+		} else if err != nil {
+			return err
+		}
+	}
+
+	labelIDs := slices.Concat(filters.LabelIDs, actions.AddLabelIDs, actions.RemoveLabelIDs)
+	if len(labelIDs) == 0 {
+		return nil
+	}
+	labels, err := GetProjectLabels(ctx, project)
+	if err != nil {
+		return err
+	}
+	for _, labelID := range labelIDs {
+		if !slices.ContainsFunc(labels, func(l *issues_model.Label) bool { return l.ID == labelID }) {
+			return util.ErrorWrap(util.ErrUnprocessableContent, "invalid label: %d", labelID)
+		}
+	}
+	return nil
+}
+
+func uniqueIDs(ids []int64) []int64 {
+	return slices.Compact(slices.Sorted(slices.Values(ids)))
+}

services/projects/workflow_notifier.go

@@ -0,0 +1,197 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package project
+
+import (
+	"context"
+	"slices"
+
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/log"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/util"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
+)
+
+func init() {
+	notify_service.RegisterNotifier(&workflowNotifier{})
+}
+
+type workflowNotifier struct {
+	notify_service.NullNotifier
+}
+
+func (*workflowNotifier) IssueChangeStatus(ctx context.Context, doer *user_model.User, _ string, issue *issues_model.Issue, _ *issues_model.Comment, isClosed bool) {
+	runIssueProjectsWorkflows(ctx, doer, issue, util.Iif(isClosed, project_model.WorkflowEventItemClosed, project_model.WorkflowEventItemReopened))
+}
+
+func (*workflowNotifier) IssueChangeProjects(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, addedProjectIDs, removedProjectIDs []int64) {
+	runWorkflows(ctx, doer, issue, removedProjectIDs, project_model.WorkflowEventItemRemovedFromProject, workflowTrigger{})
+	runWorkflows(ctx, doer, issue, addedProjectIDs, project_model.WorkflowEventItemAddedToProject, workflowTrigger{})
+}
+
+func (*workflowNotifier) IssueChangeProjectColumn(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, oldColumnID int64, newColumn *project_model.Column) {
+	runWorkflows(ctx, doer, issue, []int64{newColumn.ProjectID}, project_model.WorkflowEventItemColumnChanged, workflowTrigger{
+		sourceColumnID: oldColumnID,
+		targetColumnID: newColumn.ID,
+	})
+}
+
+func (*workflowNotifier) MergePullRequest(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+	if err := pr.LoadIssue(ctx); err != nil {
+		log.Error("LoadIssue: %v", err)
+		return
+	}
+	runIssueProjectsWorkflows(ctx, doer, pr.Issue, project_model.WorkflowEventPullRequestMerged)
+}
+
+func (m *workflowNotifier) AutoMergePullRequest(ctx context.Context, doer *user_model.User, pr *issues_model.PullRequest) {
+	m.MergePullRequest(ctx, doer, pr)
+}
+
+func (*workflowNotifier) PullRequestReview(ctx context.Context, pr *issues_model.PullRequest, review *issues_model.Review, _ *issues_model.Comment, _ []*user_model.User) {
+	if !review.Official || (review.Type != issues_model.ReviewTypeApprove && review.Type != issues_model.ReviewTypeReject) {
+		return
+	}
+	if err := pr.LoadIssue(ctx); err != nil {
+		log.Error("LoadIssue: %v", err)
+		return
+	}
+	runIssueProjectsWorkflows(ctx, review.Reviewer, pr.Issue, util.Iif(review.Type == issues_model.ReviewTypeApprove, project_model.WorkflowEventCodeReviewApproved, project_model.WorkflowEventCodeChangesRequested))
+}
+
+type workflowTrigger struct {
+	sourceColumnID int64
+	targetColumnID int64
+}
+
+func runIssueProjectsWorkflows(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, event project_model.WorkflowEvent) {
+	if issues_model.IsProjectWorkflowContext(ctx) {
+		return
+	}
+	projectIDs, err := issue.ProjectIDs(ctx)
+	if err != nil {
+		log.Error("ProjectIDs: %v", err)
+		return
+	}
+	runWorkflows(ctx, doer, issue, projectIDs, event, workflowTrigger{})
+}
+
+func runWorkflows(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, projectIDs []int64, event project_model.WorkflowEvent, trigger workflowTrigger) {
+	if len(projectIDs) == 0 || issues_model.IsProjectWorkflowContext(ctx) {
+		return
+	}
+	if err := issue.LoadRepo(ctx); err != nil {
+		log.Error("LoadRepo: %v", err)
+		return
+	}
+	if issue.Repo.IsArchived {
+		return
+	}
+	workflows, err := project_model.FindEnabledWorkflows(ctx, issue.Repo, projectIDs, event)
+	if err != nil {
+		log.Error("FindEnabledWorkflows: %v", err)
+		return
+	}
+	if len(workflows) == 0 {
+		return
+	}
+	repo := issue.Repo
+	// the caller and the notifiers after this one keep using their issue, don't change it under them
+	issue, err = issues_model.GetIssueByID(ctx, issue.ID)
+	if err != nil {
+		log.Error("GetIssueByID: %v", err)
+		return
+	}
+	issue.Repo = repo
+	if err := issue.LoadLabels(ctx); err != nil {
+		log.Error("LoadLabels: %v", err)
+		return
+	}
+	// filters see the item as the event left it, not as earlier workflows changed it
+	matched := slices.DeleteFunc(workflows, func(wf *project_model.Workflow) bool { return !matchWorkflowFilters(wf, issue, trigger) })
+	for _, wf := range matched {
+		executeWorkflowActions(ctx, wf, doer, issue)
+	}
+}
+
+func matchWorkflowFilters(wf *project_model.Workflow, issue *issues_model.Issue, trigger workflowTrigger) bool {
+	if wf.UnsupportedRule() != "" {
+		return false
+	}
+	filters := wf.WorkflowFilters
+	if filters.IssueType != "" && filters.IssueType != util.Iif(issue.IsPull, project_model.WorkflowIssueTypePullRequest, project_model.WorkflowIssueTypeIssue) {
+		return false
+	}
+	if filters.SourceColumnID != 0 && filters.SourceColumnID != trigger.sourceColumnID {
+		return false
+	}
+	if filters.TargetColumnID != 0 && filters.TargetColumnID != trigger.targetColumnID {
+		return false
+	}
+	for _, labelID := range filters.LabelIDs {
+		if !slices.ContainsFunc(issue.Labels, func(l *issues_model.Label) bool { return l.ID == labelID }) {
+			return false
+		}
+	}
+	return true
+}
+
+func executeWorkflowActions(ctx context.Context, wf *project_model.Workflow, doer *user_model.User, issue *issues_model.Issue) {
+	ctx = issues_model.WithProjectWorkflow(ctx, wf.WorkflowEvent)
+	actions := wf.WorkflowActions
+
+	if actions.ColumnID != 0 {
+		if err := moveIssueByWorkflow(ctx, wf, doer, issue); err != nil {
+			log.Error("Project workflow %d: move issue %d: %v", wf.ID, issue.ID, err)
+		}
+	}
+
+	if len(actions.AddLabelIDs) > 0 || len(actions.RemoveLabelIDs) > 0 {
+		if err := changeLabelsByWorkflow(ctx, doer, issue, actions.AddLabelIDs, actions.RemoveLabelIDs); err != nil {
+			log.Error("Project workflow %d: change labels of issue %d: %v", wf.ID, issue.ID, err)
+		}
+	}
+
+	var err error
+	if actions.IssueState == project_model.WorkflowIssueStateClose && !issue.IsClosed {
+		err = issue_service.CloseIssue(ctx, issue, doer, "")
+	} else if actions.IssueState == project_model.WorkflowIssueStateReopen && issue.IsClosed && !issue.IsPull { // pull requests need the reopen checks of the pull request handlers
+		err = issue_service.ReopenIssue(ctx, issue, doer, "")
+	}
+	if err != nil {
+		log.Error("Project workflow %d: change state of issue %d: %v", wf.ID, issue.ID, err)
+	}
+}
+
+func moveIssueByWorkflow(ctx context.Context, wf *project_model.Workflow, doer *user_model.User, issue *issues_model.Issue) error {
+	column, err := project_model.GetColumnByIDAndProjectID(ctx, wf.WorkflowActions.ColumnID, wf.ProjectID)
+	if project_model.IsErrProjectColumnNotExist(err) {
+		log.Warn("Project workflow %d: column %d no longer exists", wf.ID, wf.WorkflowActions.ColumnID)
+		return nil
+	} else if err != nil {
+		return err
+	}
+	columnIDs, err := issue.ProjectColumnMap(ctx)
+	if err != nil {
+		return err
+	}
+	if columnIDs[wf.ProjectID] == column.ID {
+		return nil
+	}
+	return MoveIssueToColumn(ctx, doer, issue, column, optional.None[int64]())
+}
+
+func changeLabelsByWorkflow(ctx context.Context, doer *user_model.User, issue *issues_model.Issue, addLabelIDs, removeLabelIDs []int64) error {
+	labels, err := issues_model.GetLabelsByIDs(ctx, slices.Concat(addLabelIDs, removeLabelIDs))
+	if err != nil {
+		return err
+	}
+	addLabels := slices.DeleteFunc(slices.Clone(labels), func(l *issues_model.Label) bool { return !slices.Contains(addLabelIDs, l.ID) })
+	removeLabels := slices.DeleteFunc(labels, func(l *issues_model.Label) bool { return !slices.Contains(removeLabelIDs, l.ID) })
+	return issue_service.AddRemoveLabels(ctx, issue, doer, addLabels, removeLabels)
+}

services/projects/workflow_test.go

@@ -0,0 +1,290 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package project
+
+import (
+	"context"
+	"testing"
+
+	audit_model "gitea.dev/models/audit"
+	"gitea.dev/models/db"
+	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
+	project_model "gitea.dev/models/project"
+	repo_model "gitea.dev/models/repo"
+	"gitea.dev/models/unit"
+	"gitea.dev/models/unittest"
+	user_model "gitea.dev/models/user"
+	"gitea.dev/modules/container"
+	"gitea.dev/modules/optional"
+	"gitea.dev/modules/setting"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/modules/test"
+	"gitea.dev/modules/util"
+	issue_service "gitea.dev/services/issue"
+	notify_service "gitea.dev/services/notify"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestMatchWorkflowFilters(t *testing.T) {
+	issue := &issues_model.Issue{Labels: []*issues_model.Label{{ID: 1}}}
+	pull := &issues_model.Issue{IsPull: true}
+	moved := workflowTrigger{sourceColumnID: 1, targetColumnID: 2}
+	added, columnChanged := project_model.WorkflowEventItemAddedToProject, project_model.WorkflowEventItemColumnChanged
+	tests := []struct {
+		name    string
+		event   project_model.WorkflowEvent
+		filters project_model.WorkflowFilters
+		issue   *issues_model.Issue
+		trigger workflowTrigger
+		want    bool
+	}{
+		{"no filters", added, project_model.WorkflowFilters{}, issue, workflowTrigger{}, true},
+		{"issue type", added, project_model.WorkflowFilters{IssueType: "issue"}, issue, workflowTrigger{}, true},
+		{"other issue type", added, project_model.WorkflowFilters{IssueType: "issue"}, pull, workflowTrigger{}, false},
+		{"label", added, project_model.WorkflowFilters{LabelIDs: []int64{1}}, issue, workflowTrigger{}, true},
+		{"missing label", added, project_model.WorkflowFilters{LabelIDs: []int64{1, 2}}, issue, workflowTrigger{}, false},
+		{"columns", columnChanged, project_model.WorkflowFilters{SourceColumnID: 1, TargetColumnID: 2}, issue, moved, true},
+		{"other target", columnChanged, project_model.WorkflowFilters{TargetColumnID: 3}, issue, moved, false},
+		{"no column supplied", columnChanged, project_model.WorkflowFilters{SourceColumnID: 1}, issue, workflowTrigger{}, false},
+		{"unsupported by event", added, project_model.WorkflowFilters{TargetColumnID: 2}, issue, moved, false},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			wf := &project_model.Workflow{WorkflowEvent: test.event, WorkflowFilters: test.filters}
+			assert.Equal(t, test.want, matchWorkflowFilters(wf, test.issue, test.trigger))
+		})
+	}
+}
+
+func TestCanManageWorkflows(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	user := func(id int64) *user_model.User { return unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: id}) }
+	publicOnly := func(id int64) *user_model.User {
+		doer := *user(id)
+		doer.ExtDoerData = user_model.NewTokenExtDoerData(user_model.CredentialAccessToken, 1, "public-only,write:issue")
+		return &doer
+	}
+	repoProject := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 2})
+	orgProject := &project_model.Project{Title: "org", OwnerID: 3, Type: project_model.TypeOrganization}
+	userProject := &project_model.Project{Title: "user", OwnerID: 2, Type: project_model.TypeIndividual}
+	for _, tc := range []struct {
+		project *project_model.Project
+		doer    *user_model.User
+		want    bool
+	}{
+		{repoProject, user(4), true},
+		{repoProject, user(5), false},
+		{orgProject, user(2), true},
+		{orgProject, user(1), true},
+		{orgProject, user(4), false},
+		{orgProject, publicOnly(2), false},
+		{userProject, user(2), true},
+		{userProject, user(1), false},
+		{userProject, publicOnly(2), false},
+	} {
+		allowed, err := CanManageWorkflows(t.Context(), tc.doer, tc.project)
+		require.NoError(t, err)
+		assert.Equal(t, tc.want, allowed, "project %q, user %d", tc.project.Title, tc.doer.ID)
+	}
+	for _, removedUnit := range []unit.Type{unit.TypeIssues, unit.TypePullRequests} {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		_, err := db.Exec(t.Context(), "UPDATE team SET authorize = ? WHERE id = ?", perm.AccessModeNone, 2)
+		require.NoError(t, err)
+		_, err = db.DeleteByBean(t.Context(), &organization.TeamUnit{TeamID: 2, Type: removedUnit})
+		require.NoError(t, err)
+		allowed, err := CanManageWorkflows(t.Context(), user(4), repoProject)
+		require.NoError(t, err)
+		assert.False(t, allowed, removedUnit.LogString())
+	}
+}
+
+func TestCreateUpdateWorkflow(t *testing.T) {
+	require.NoError(t, unittest.PrepareTestDatabase())
+	defer test.MockVariableValue(&setting.Audit.RecordOutput, setting.AuditRecordOutputDatabase)()
+	ctx := t.Context()
+	owner := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+	reader := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+	project := unittest.AssertExistsAndLoadBean(t, &project_model.Project{ID: 1})
+
+	t.Run("Rejects", func(t *testing.T) {
+		tests := []struct {
+			name string
+			doer *user_model.User
+			opts api.CreateProjectWorkflowOption
+			code int
+		}{
+			{"unknown event", owner, api.CreateProjectWorkflowOption{Event: "bogus", Actions: api.ProjectWorkflowActions{ColumnID: 2}}, 422},
+			{"no actions", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project"}, 422},
+			{"other project column", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{ColumnID: 4}}, 422},
+			{"other owner label", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{AddLabelIDs: []int64{3}}}, 422},
+			{"unsupported filter", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Filters: api.ProjectWorkflowFilters{SourceColumnID: 1}, Actions: api.ProjectWorkflowActions{ColumnID: 2}}, 422},
+			{"unsupported action", owner, api.CreateProjectWorkflowOption{Event: "item_removed_from_project", Actions: api.ProjectWorkflowActions{ColumnID: 2}}, 422},
+			{"unknown issue state", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{IssueState: "bogus"}}, 422},
+			{"reopen pull requests", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Filters: api.ProjectWorkflowFilters{IssueType: "pull_request"}, Actions: api.ProjectWorkflowActions{IssueState: "reopen"}}, 422},
+			{"unknown issue type", owner, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Filters: api.ProjectWorkflowFilters{IssueType: "bogus"}, Actions: api.ProjectWorkflowActions{ColumnID: 2}}, 422},
+			{"without issue and pull request write", reader, api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{ColumnID: 2}}, 403},
+		}
+		for _, test := range tests {
+			t.Run(test.name, func(t *testing.T) {
+				_, err := CreateWorkflow(ctx, test.doer, project, &test.opts)
+				_, code := util.ErrorUnwrapForUser(err)
+				assert.Equal(t, test.code, code)
+			})
+		}
+	})
+
+	t.Run("PartialUpdate", func(t *testing.T) {
+		wf, err := CreateWorkflow(ctx, owner, project, &api.CreateProjectWorkflowOption{
+			Event:   "item_added_to_project",
+			Filters: api.ProjectWorkflowFilters{IssueType: "issue", LabelIDs: []int64{2, 1, 2}},
+			Actions: api.ProjectWorkflowActions{ColumnID: 2},
+		})
+		require.NoError(t, err)
+
+		require.NoError(t, UpdateWorkflow(ctx, owner, project, wf, &api.EditProjectWorkflowOption{Enabled: new(false)}))
+		require.NoError(t, UpdateWorkflow(ctx, owner, project, wf, &api.EditProjectWorkflowOption{Actions: &api.ProjectWorkflowActions{AddLabelIDs: []int64{1}}}))
+
+		unittest.AssertExistsAndLoadBean(t, &audit_model.Event{Action: audit_model.ProjectWorkflowCreate, ActorID: owner.ID, ScopeType: audit_model.ScopeRepository, ScopeID: project.RepoID})
+
+		stored := unittest.AssertExistsAndLoadBean(t, &project_model.Workflow{ID: wf.ID})
+		assert.False(t, stored.Enabled)
+		assert.Equal(t, project_model.WorkflowFilters{IssueType: "issue", LabelIDs: []int64{1, 2}}, stored.WorkflowFilters)
+		assert.Equal(t, project_model.WorkflowActions{AddLabelIDs: []int64{1}}, stored.WorkflowActions)
+
+		assert.ErrorIs(t, UpdateWorkflow(ctx, reader, project, stored, &api.EditProjectWorkflowOption{Enabled: new(true)}), util.ErrPermissionDenied)
+		assert.ErrorIs(t, DeleteWorkflow(ctx, reader, project, stored), util.ErrPermissionDenied)
+		require.NoError(t, DeleteWorkflow(ctx, owner, project, stored))
+		unittest.AssertNotExistsBean(t, &project_model.Workflow{ID: wf.ID})
+		for _, action := range []audit_model.Action{audit_model.ProjectWorkflowUpdate, audit_model.ProjectWorkflowDelete} {
+			unittest.AssertExistsAndLoadBean(t, &audit_model.Event{Action: action, ActorID: owner.ID, ScopeType: audit_model.ScopeRepository, ScopeID: project.RepoID})
+		}
+	})
+
+	userProject := &project_model.Project{Title: "workflows", OwnerID: owner.ID, CreatorID: owner.ID, Type: project_model.TypeIndividual}
+	require.NoError(t, project_model.NewProject(ctx, userProject))
+	_, err := CreateWorkflow(ctx, owner, userProject, &api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{IssueState: "close"}})
+	require.NoError(t, err)
+	event := unittest.AssertExistsAndLoadBean(t, &audit_model.Event{Action: audit_model.ProjectWorkflowCreate, ScopeType: audit_model.ScopeUser, ScopeID: userProject.OwnerID})
+	assert.Contains(t, event.Message, "item_added_to_project")
+}
+
+type labelChangeRecorder struct {
+	notify_service.NullNotifier
+	added [][]int64
+}
+
+func (r *labelChangeRecorder) IssueChangeLabels(_ctx context.Context, _doer *user_model.User, _issue *issues_model.Issue, added, _removed []*issues_model.Label) {
+	r.added = append(r.added, container.FilterSlice(added, func(l *issues_model.Label) (int64, bool) { return l.ID, true }))
+}
+
+func TestWorkflowExecution(t *testing.T) {
+	const labelID = 2
+	require.NoError(t, unittest.PrepareTestDatabase())
+	doer := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 2})
+
+	addLabel := project_model.WorkflowActions{AddLabelIDs: []int64{labelID}}
+	addWorkflow := func(t *testing.T, wf project_model.Workflow) {
+		wf.ProjectID, wf.Enabled = 1, true
+		require.NoError(t, project_model.CreateWorkflow(t.Context(), &wf))
+	}
+	setup := func(t *testing.T, wf project_model.Workflow) {
+		require.NoError(t, unittest.PrepareTestDatabase())
+		addWorkflow(t, wf)
+	}
+	hasLabel := func(t *testing.T, issueID int64) bool {
+		return unittest.GetCount(t, &issues_model.IssueLabel{IssueID: issueID, LabelID: labelID}) == 1
+	}
+	moveIssue := func(t *testing.T, ctx context.Context, issueID, columnID int64) {
+		issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: issueID})
+		column := unittest.AssertExistsAndLoadBean(t, &project_model.Column{ID: columnID})
+		require.NoError(t, MoveIssueToColumn(ctx, doer, issue, column, optional.None[int64]()))
+	}
+
+	t.Run("ColumnChangedFromDefaultColumn", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemColumnChanged, WorkflowFilters: project_model.WorkflowFilters{SourceColumnID: 1, TargetColumnID: 2}, WorkflowActions: addLabel})
+		moveIssue(t, t.Context(), 2, 2)
+		assert.True(t, hasLabel(t, 2))
+	})
+
+	t.Run("NoOpMoveWithinDefaultColumn", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemColumnChanged, WorkflowActions: addLabel})
+		moveIssue(t, t.Context(), 2, 1)
+		assert.False(t, hasLabel(t, 2))
+		unittest.AssertNotExistsBean(t, &issues_model.Comment{IssueID: 2, Type: issues_model.CommentTypeProjectColumn})
+	})
+
+	t.Run("NoCascadeFromWorkflows", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemColumnChanged, WorkflowActions: addLabel})
+		moveIssue(t, issues_model.WithProjectWorkflow(t.Context(), project_model.WorkflowEventItemAddedToProject), 1, 2)
+		assert.False(t, hasLabel(t, 1))
+	})
+
+	t.Run("LabelsAndClosesPullRequestAsTriggeringReader", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemColumnChanged, WorkflowActions: project_model.WorkflowActions{AddLabelIDs: []int64{labelID}, IssueState: project_model.WorkflowIssueStateClose}})
+		reader := unittest.AssertExistsAndLoadBean(t, &user_model.User{ID: 5})
+		require.NoError(t, MoveIssueToColumn(t.Context(), reader, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3}), unittest.AssertExistsAndLoadBean(t, &project_model.Column{ID: 3}), optional.None[int64]()))
+		assert.True(t, hasLabel(t, 3))
+		assert.True(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3}).IsClosed)
+		for _, commentType := range []issues_model.CommentType{issues_model.CommentTypeLabel, issues_model.CommentTypeClose} {
+			comment := unittest.AssertExistsAndLoadBean(t, &issues_model.Comment{IssueID: 3, Type: commentType})
+			assert.Equal(t, reader.ID, comment.PosterID)
+			assert.Equal(t, &issues_model.CommentMetaData{
+				ProjectWorkflowEvent: project_model.WorkflowEventItemColumnChanged,
+				SpecialDoerName:      issues_model.SpecialDoerNameProjectWorkflow,
+			}, comment.CommentMetaData)
+		}
+	})
+
+	t.Run("ArchivedRepository", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemClosed, WorkflowActions: addLabel})
+		require.NoError(t, repo_model.UpdateRepositoryColsNoAutoTime(t.Context(), &repo_model.Repository{ID: 1, IsArchived: true}, "is_archived"))
+		(&workflowNotifier{}).IssueChangeStatus(t.Context(), doer, "", unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 1}), nil, true)
+		assert.False(t, hasLabel(t, 1))
+	})
+
+	t.Run("ReopenSkipsPullRequests", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemColumnChanged, WorkflowActions: project_model.WorkflowActions{IssueState: project_model.WorkflowIssueStateReopen}})
+		require.NoError(t, issues_model.UpdateIssueCols(t.Context(), &issues_model.Issue{ID: 3, IsClosed: true}, "is_closed"))
+		moveIssue(t, t.Context(), 3, 1)
+		moveIssue(t, t.Context(), 5, 1)
+		assert.True(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 3}).IsClosed)
+		assert.False(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 5}).IsClosed)
+	})
+
+	t.Run("OfficialReviewsOnly", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventCodeReviewApproved, WorkflowActions: addLabel})
+		pr := unittest.AssertExistsAndLoadBean(t, &issues_model.PullRequest{IssueID: 3})
+		review := &issues_model.Review{Type: issues_model.ReviewTypeApprove, Reviewer: doer}
+		(&workflowNotifier{}).PullRequestReview(t.Context(), pr, review, nil, nil)
+		assert.False(t, hasLabel(t, 3))
+		review.Official = true
+		(&workflowNotifier{}).PullRequestReview(t.Context(), pr, review, nil, nil)
+		assert.True(t, hasLabel(t, 3))
+	})
+
+	t.Run("AddedToAndRemovedFromProject", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemAddedToProject, WorkflowActions: addLabel})
+		addWorkflow(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemRemovedFromProject, WorkflowActions: project_model.WorkflowActions{RemoveLabelIDs: []int64{labelID}}})
+		issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: 11})
+		column := unittest.AssertExistsAndLoadBean(t, &project_model.Column{ID: 2})
+		require.NoError(t, AddIssueToColumn(t.Context(), doer, issue, column))
+		assert.True(t, hasLabel(t, 11))
+		require.NoError(t, RemoveIssueFromColumn(t.Context(), doer, issue, column))
+		assert.False(t, hasLabel(t, 11))
+	})
+
+	t.Run("NewItemInProject", func(t *testing.T) {
+		setup(t, project_model.Workflow{WorkflowEvent: project_model.WorkflowEventItemAddedToProject, WorkflowActions: project_model.WorkflowActions{ColumnID: 3, AddLabelIDs: []int64{labelID}}})
+		*labelChanges = labelChangeRecorder{}
+		repo := unittest.AssertExistsAndLoadBean(t, &repo_model.Repository{ID: 1})
+		issue := &issues_model.Issue{RepoID: repo.ID, PosterID: doer.ID, Title: "new item"}
+		require.NoError(t, issue_service.NewIssue(t.Context(), repo, issue, []int64{1}, nil, nil, []int64{1}))
+		assert.Equal(t, [][]int64{{1}, {labelID}}, labelChanges.added)
+		assert.EqualValues(t, 3, unittest.AssertExistsAndLoadBean(t, &project_model.ProjectIssue{IssueID: issue.ID}).ProjectColumnID)
+	})
+}