feat: Allow automatic project actions on events (#30205)

This PR introduces project workflows, allowing users to configure
event-based automations directly from the UI.
Users can define filters and actions for each workflow event, and
duplicate existing events when needed.

### Concepts

Every workflow is composed of `event`, `filters`, and `actions`.

- **Event** - An Event defines when a workflow should be triggered. It
represents specific activities such as an issue being added to the
project, a pull request being merged, or a project column being changed.
- **Filter** - A Filter refines when an event should take effect. It
allows users to specify conditions like issue type, labels, or project
columns to ensure actions only run in targeted scenarios.
- **Action** - An Action defines what happens when the event and filters
match. It performs operations such as adding labels, moving issues
between columns, or changing the issue or pull request state.

### Available Events

Currently, the following eight events are supported:

- On issues/pull requests closed
- On issues/pull requests reopened
- On issues/pull requests was added to the project, including when
created in it
- On issues/pull requests was removed from the project
- On issues/pull requests' column was changed
- On code changes requested
- On code review approved
- On pull request merged

Each event type supports its own set of filters and actions.

### Available Filters

There are four types of filters that can be configured for an event:

- **Apply to** - Specify the target type: `issues only`, `pull requests
only`, or `issues and pull requests`.
- **Labels** - Trigger the event only if the issue or pull request
contains one or more specified labels.
- **Move from column** - Filter events based on the original project
column.
- **Move to column** - Filter events based on the destination project
column.

### Available Actions

There are four types of actions that can be executed when an event is
triggered:

- **Add labels** - Automatically add one or more labels to the issue or
pull request.
- **Remove labels** - Remove one or more specified labels.
- **Move to column** - Move the issue or pull request to a designated
project column.
- **Issue state** - Close or reopen the issue. Pull requests can only be
closed.

### Enable/Disable an event workflow

Each event workflow can be individually enabled or disabled. When
disabled, the workflow will be ignored even if the event occurs. This
feature is useful when you want to temporarily stop certain automated
actions without deleting the workflow configuration. Workflows of closed
projects don't run either.

### Clone an event workflow

When you need multiple workflows for the same event, you can clone an
existing event to create a new one with different filters and actions.
This allows you to customize how the same event behaves under different
conditions, making workflows more flexible and powerful.

### Permissions

Permissions are checked when workflows are managed, not when they run:

- Viewing a project's workflows needs read access to the project
- Managing them needs write access to the project plus write access to
both issues and pull requests of a repository project's repository,
being an owner of an organization project's organization or a site
administrator, or being the user of a user project. Tokens limited to
public repositories can't manage owner-level projects' workflows
- A workflow runs when its event happens to an item of an open project
that can hold the item's repository, unless that repository is archived,
no matter who caused the event, and applies its actions without further
permission checks. Pull requests are never reopened
- Changes show as made by "Project workflow" on behalf of the user who
triggered the event and don't trigger other workflows
- Only users who can read an item can put it on a board or move its card

The management rule is also documented on `CanManageWorkflows` in
`services/projects/workflow.go`.

Fixes:  #14359
Fixes: #26704
Fixes: #27990
Replaces:  #28745
Documentation PR: https://gitea.com/gitea/docs/pulls/308
Co-authored-by: bircni <bircni@icloud.com>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: Giteabot <teabot@gitea.io>

tests/e2e/project-workflow.test.ts

@@ -0,0 +1,91 @@
+import {env} from 'node:process';
+import {test, expect} from '@playwright/test';
+import {
+  apiCreateLabel, apiCreateProject, apiCreateRepo, apiDeleteRepo, createProjectColumn, login, logout, randomString,
+} from './utils.ts';
+import type {Page} from '@playwright/test';
+
+const owner = env.GITEA_TEST_E2E_USER;
+
+const sidebar = (page: Page) => page.getByRole('navigation', {name: 'Default workflows'});
+const workflowLink = (page: Page, name: string) => sidebar(page).getByRole('link', {name});
+const editor = (page: Page) => page.getByRole('form', {name: /^Item added to project/});
+const editorButton = (page: Page, name: string) => editor(page).getByRole('button', {name, exact: true});
+const editorField = (page: Page, name: string) => editor(page).getByRole('button', {name});
+
+async function choose(page: Page, field: string, option: string) {
+  await editorField(page, field).click();
+  await page.getByRole('menuitemradio', {name: option}).click();
+}
+
+async function createWorkflowProject(page: Page) {
+  const repo = `e2e-project-workflow-${randomString(8)}`;
+  await Promise.all([login(page), apiCreateRepo(page.request, {name: repo, autoInit: false})]);
+  const id = await apiCreateProject(page.request, owner, repo, 'Workflows');
+  await Promise.all(['Backlog', 'Done'].map((title) => createProjectColumn(page.request, owner, repo, String(id), title)));
+  return {repo, url: `/${owner}/${repo}/projects/${id}/workflows`};
+}
+
+async function configureItemAdded(page: Page, column: string) {
+  await workflowLink(page, 'Item added to project').click();
+  await choose(page, 'Move to column', column);
+  await editorButton(page, 'Save').click();
+}
+
+test('project workflow: configure, toggle, edit and view read-only', async ({page}) => {
+  const {repo, url} = await createWorkflowProject(page);
+  try {
+    await page.goto(url);
+    await expect(sidebar(page).getByRole('link')).toHaveCount(8);
+    await choose(page, 'Apply to', 'Issues only');
+    await configureItemAdded(page, 'Backlog');
+    await expect(page).toHaveURL(/\/workflows\/\d+$/);
+    await expect(editor(page).getByLabel('Apply to')).toHaveText('Issues only');
+    await expect(workflowLink(page, 'Item added to project')).toContainText('(Issues only)');
+
+    await editorButton(page, 'Disable').click();
+    await expect(workflowLink(page, 'Item added to project').getByRole('img', {name: 'Disabled'})).toBeVisible();
+    await editorButton(page, 'Enable').click();
+    await expect(workflowLink(page, 'Item added to project').getByRole('img', {name: 'Enabled'})).toBeVisible();
+
+    await page.goto(`${url}?event=item_added_to_project`);
+    await expect(editor(page).getByLabel('Move to column')).toHaveText('Backlog');
+
+    await editorButton(page, 'Edit').click();
+    await expect(editorField(page, 'Apply to')).toHaveText('Issues only');
+    await choose(page, 'Move to column', 'Done');
+    await editorButton(page, 'Save').click();
+    await expect(editorButton(page, 'Edit')).toBeVisible();
+
+    await logout(page);
+    await page.goto(url);
+    await expect(editor(page).getByLabel('Move to column')).toHaveText('Done');
+    await expect(editor(page).getByRole('button')).toHaveCount(0);
+  } finally {
+    await apiDeleteRepo(page.request, owner, repo);
+  }
+});
+
+test('project workflow: clone with labels and delete', async ({page}) => {
+  const {repo, url} = await createWorkflowProject(page);
+  try {
+    await apiCreateLabel(page.request, owner, repo, 'bug', 'ee0701');
+    await page.goto(url);
+    await configureItemAdded(page, 'Backlog');
+
+    await editorButton(page, 'Clone').click();
+    await editorField(page, 'Add labels').click();
+    await page.getByRole('menuitemcheckbox', {name: 'bug'}).click();
+    await editorButton(page, 'Save').click();
+    await expect(editor(page).getByRole('group', {name: 'Add labels'})).toHaveText('bug');
+    await expect(workflowLink(page, 'Item added to project #2')).toHaveAttribute('aria-current', 'page');
+
+    await editorButton(page, 'Edit').click();
+    await editorButton(page, 'Remove').click();
+    await page.getByRole('button', {name: 'Confirm', exact: true}).click();
+    await expect(workflowLink(page, 'Item added to project')).toHaveCount(1);
+    await expect(editor(page).getByLabel('Move to column')).toHaveText('Backlog');
+  } finally {
+    await apiDeleteRepo(page.request, owner, repo);
+  }
+});

tests/e2e/utils.ts

@@ -130,6 +130,21 @@ export async function createProjectColumn(requestContext: APIRequestContext, own
   }), 'createProjectColumn');
 }
 
+export async function apiCreateProject(requestContext: APIRequestContext, owner: string, repo: string, title: string): Promise<number> {
+  const response = await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/repos/${owner}/${repo}/projects`, {
+    headers: apiHeaders(),
+    data: {title},
+  }), 'apiCreateProject');
+  return (await response.json()).id;
+}
+
+export async function apiCreateLabel(requestContext: APIRequestContext, owner: string, repo: string, name: string, color: string) {
+  await apiRetry(() => requestContext.post(`${baseUrl()}/api/v1/repos/${owner}/${repo}/labels`, {
+    headers: apiHeaders(),
+    data: {name, color},
+  }), 'apiCreateLabel');
+}
+
 export async function apiDeleteRepo(requestContext: APIRequestContext, owner: string, name: string) {
   await apiRetry(() => requestContext.delete(`${baseUrl()}/api/v1/repos/${owner}/${name}`, {
     headers: apiHeaders(),

tests/integration/api_issue_test.go

@@ -650,4 +650,8 @@ func testAPIIssueProjects(t *testing.T) {
 		Projects: []int64{2},
 	}).AddTokenAuth(token)
 	MakeRequest(t, req, http.StatusBadRequest)
+
+	readerToken := getUserToken(t, "user4", auth_model.AccessTokenScopeWriteIssue)
+	req = NewRequestWithJSON(t, "POST", urlStr, &api.CreateIssueOption{Title: "issue by a reader", Projects: []int64{1}}).AddTokenAuth(readerToken)
+	assert.Empty(t, DecodeJSON(t, MakeRequest(t, req, http.StatusCreated), &api.Issue{}).Projects)
 }

tests/integration/api_project_test.go

@@ -11,8 +11,12 @@ import (
 	"testing"
 
 	auth_model "gitea.dev/models/auth"
+	"gitea.dev/models/db"
 	issues_model "gitea.dev/models/issues"
+	"gitea.dev/models/organization"
+	"gitea.dev/models/perm"
 	project_model "gitea.dev/models/project"
+	"gitea.dev/models/unit"
 	"gitea.dev/models/unittest"
 	api "gitea.dev/modules/structs"
 	"gitea.dev/tests"
@@ -88,6 +92,14 @@ func TestAPIProjects(t *testing.T) {
 	t.Run("Permissions", func(t *testing.T) { testAPIProjectPermissions(t, token, outsider) })
 	t.Run("Visibility", func(t *testing.T) { testAPIProjectVisibility(t, outsider) })
 	t.Run("RepoProjectsModeOwner", func(t *testing.T) { testAPIRepoProjectsModeOwner(t, token) })
+	t.Run("RepoBoardNeedsIssueRead", func(t *testing.T) {
+		_, err := db.Exec(t.Context(), "UPDATE team SET authorize = ? WHERE id = ?", perm.AccessModeNone, 2)
+		require.NoError(t, err)
+		_, err = db.DeleteByBean(t.Context(), &organization.TeamUnit{TeamID: 2, Type: unit.TypeIssues})
+		require.NoError(t, err)
+		projectsWriter := getUserToken(t, "user4", auth_model.AccessTokenScopeWriteIssue, auth_model.AccessTokenScopeWriteRepository)
+		MakeRequest(t, NewRequest(t, "POST", "/api/v1/repos/org3/repo3/projects/2/columns/5/issues/6").AddTokenAuth(projectsWriter), http.StatusNotFound)
+	})
 }
 
 func testProjectLifecycle(t *testing.T, scope projectScope, token string) {

tests/integration/api_project_workflow_test.go

@@ -0,0 +1,86 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	project_model "gitea.dev/models/project"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAPIProjectWorkflows(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	token := getUserToken(t, "user2", auth_model.AccessTokenScopeWriteIssue, auth_model.AccessTokenScopeWriteOrganization)
+	listURL := "/api/v1/repos/user2/repo1/projects/1/workflows"
+
+	req := NewRequestWithJSON(t, "POST", listURL, &api.CreateProjectWorkflowOption{
+		Event:   "item_column_changed",
+		Filters: api.ProjectWorkflowFilters{IssueType: "issue", TargetColumnID: 3},
+		Actions: api.ProjectWorkflowActions{AddLabelIDs: []int64{1}, IssueState: "close"},
+	}).AddTokenAuth(token)
+	created := DecodeJSON(t, MakeRequest(t, req, http.StatusCreated), &api.ProjectWorkflow{})
+	assert.Equal(t, "item_column_changed", created.Event)
+	assert.True(t, created.Enabled)
+	assert.Equal(t, api.ProjectWorkflowFilters{IssueType: "issue", TargetColumnID: 3}, created.Filters)
+	assert.Equal(t, api.ProjectWorkflowActions{AddLabelIDs: []int64{1}, IssueState: "close"}, created.Actions)
+	workflowURL := fmt.Sprintf("%s/%d", listURL, created.ID)
+
+	fetched := DecodeJSON(t, MakeRequest(t, NewRequest(t, "GET", workflowURL).AddTokenAuth(token), http.StatusOK), &api.ProjectWorkflow{})
+	assert.Equal(t, created.Filters, fetched.Filters)
+	assert.Equal(t, created.Actions, fetched.Actions)
+
+	resp := MakeRequest(t, NewRequest(t, "GET", listURL).AddTokenAuth(token), http.StatusOK)
+	assert.Equal(t, "1", resp.Header().Get("X-Total-Count"))
+	listed := DecodeJSON(t, resp, []*api.ProjectWorkflow{})
+	require.Len(t, listed, 1)
+	assert.Equal(t, created.ID, listed[0].ID)
+
+	req = NewRequestWithJSON(t, "PATCH", workflowURL, &api.EditProjectWorkflowOption{Filters: &api.ProjectWorkflowFilters{SourceColumnID: 1}}).AddTokenAuth(token)
+	updated := DecodeJSON(t, MakeRequest(t, req, http.StatusOK), &api.ProjectWorkflow{})
+	assert.Equal(t, api.ProjectWorkflowFilters{SourceColumnID: 1}, updated.Filters)
+	assert.Equal(t, created.Actions, updated.Actions)
+
+	req = NewRequestWithJSON(t, "PATCH", workflowURL, &api.EditProjectWorkflowOption{Filters: &api.ProjectWorkflowFilters{LabelIDs: []int64{999999}}}).AddTokenAuth(token)
+	assert.Contains(t, MakeRequest(t, req, http.StatusUnprocessableEntity).Body.String(), "invalid label")
+
+	outsider := getUserToken(t, "user4", auth_model.AccessTokenScopeWriteIssue)
+	req = NewRequestWithJSON(t, "POST", listURL, &api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{ColumnID: 3}}).AddTokenAuth(outsider)
+	MakeRequest(t, req, http.StatusForbidden)
+	MakeRequest(t, NewRequest(t, "DELETE", workflowURL).AddTokenAuth(outsider), http.StatusForbidden)
+
+	MakeRequest(t, NewRequest(t, "DELETE", workflowURL).AddTokenAuth(token), http.StatusNoContent)
+	MakeRequest(t, NewRequest(t, "GET", workflowURL).AddTokenAuth(token), http.StatusNotFound)
+
+	t.Run("CreateClosedIssueThatWorkflowCloses", func(t *testing.T) {
+		req := NewRequestWithJSON(t, "POST", listURL, &api.CreateProjectWorkflowOption{Event: "item_added_to_project", Actions: api.ProjectWorkflowActions{IssueState: "close"}}).AddTokenAuth(token)
+		MakeRequest(t, req, http.StatusCreated)
+		req = NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/issues", &api.CreateIssueOption{Title: "closed", Projects: []int64{1}, Closed: true}).AddTokenAuth(token)
+		assert.Equal(t, api.StateClosed, DecodeJSON(t, MakeRequest(t, req, http.StatusCreated), &api.Issue{}).State)
+	})
+
+	t.Run("Organization", func(t *testing.T) {
+		orgProject := &project_model.Project{Title: "org workflows", OwnerID: 3, CreatorID: 2, Type: project_model.TypeOrganization}
+		require.NoError(t, project_model.NewProject(t.Context(), orgProject))
+		column := &project_model.Column{Title: "Done", ProjectID: orgProject.ID}
+		require.NoError(t, project_model.NewColumn(t.Context(), column))
+		orgListURL := fmt.Sprintf("/api/v1/orgs/org3/projects/%d/workflows", orgProject.ID)
+		req := NewRequestWithJSON(t, "POST", orgListURL, &api.CreateProjectWorkflowOption{
+			Event:   "item_closed",
+			Actions: api.ProjectWorkflowActions{ColumnID: column.ID},
+		}).AddTokenAuth(token)
+		created := DecodeJSON(t, MakeRequest(t, req, http.StatusCreated), &api.ProjectWorkflow{})
+		listed := DecodeJSON(t, MakeRequest(t, NewRequest(t, "GET", orgListURL).AddTokenAuth(token), http.StatusOK), []*api.ProjectWorkflow{})
+		require.Len(t, listed, 1)
+		assert.Equal(t, created.ID, listed[0].ID)
+	})
+}

tests/integration/project_test.go

@@ -110,6 +110,18 @@ func TestUpdateIssueProject(t *testing.T) {
 		sess.MakeRequest(t, req, http.StatusOK)
 		unittest.AssertNotExistsBean(t, &project_model.ProjectIssue{IssueID: 2, ProjectID: 1})
 	})
+
+	t.Run("AssignOnCreationNeedsWriter", func(t *testing.T) {
+		newIssue := func(session *TestSession, title string, status int) {
+			req := NewRequestWithValues(t, "POST", "/user2/repo1/issues/new", map[string]string{"title": title, "project_ids": "1"})
+			session.MakeRequest(t, req, status)
+		}
+		newIssue(sess, "writer issue", http.StatusOK)
+		issue := unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{RepoID: 1, Title: "writer issue"})
+		unittest.AssertExistsAndLoadBean(t, &project_model.ProjectIssue{IssueID: issue.ID, ProjectID: 1})
+		newIssue(loginUser(t, "user4"), "reader issue", http.StatusNotFound)
+		unittest.AssertNotExistsBean(t, &issues_model.Issue{RepoID: 1, Title: "reader issue"})
+	})
 }
 
 func TestUpdateIssueProjectColumn(t *testing.T) {
@@ -314,8 +326,10 @@ func TestOrgProjectFilterByMilestone(t *testing.T) {
 	require.NoError(t, project_model.NewProject(t.Context(), &project))
 
 	// Add issues to the project
-	require.NoError(t, issues_model.IssueAssignOrRemoveProject(t.Context(), issue16, user1, []int64{project.ID}))
-	require.NoError(t, issues_model.IssueAssignOrRemoveProject(t.Context(), issue17, user1, []int64{project.ID}))
+	for _, issue := range []*issues_model.Issue{issue16, issue17} {
+		_, _, err := issues_model.IssueAssignOrRemoveProject(t.Context(), issue, user1, []int64{project.ID})
+		require.NoError(t, err)
+	}
 
 	sess := loginUser(t, "user1")
 	projectURL := fmt.Sprintf("/org3/-/projects/%d", project.ID)

tests/integration/project_workflow_test.go

@@ -0,0 +1,98 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package integration
+
+import (
+	"fmt"
+	"net/http"
+	"testing"
+
+	auth_model "gitea.dev/models/auth"
+	issues_model "gitea.dev/models/issues"
+	project_model "gitea.dev/models/project"
+	"gitea.dev/models/unittest"
+	api "gitea.dev/modules/structs"
+	"gitea.dev/tests"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestProjectWorkflowsWeb(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	link := "/user2/repo1/projects/1/workflows"
+	session := loginUser(t, "user2")
+
+	canWrite := func(session *TestSession) string {
+		resp := session.MakeRequest(t, NewRequest(t, "GET", link), http.StatusOK)
+		return NewHTMLParser(t, resp.Body).Find("#project-workflows").AttrOr("data-can-write", "")
+	}
+	assert.Equal(t, "true", canWrite(session))
+	assert.Equal(t, "false", canWrite(nil))
+	session.MakeRequest(t, NewRequest(t, "GET", link+"?event=item_closed"), http.StatusOK)
+	session.MakeRequest(t, NewRequest(t, "GET", link+"?event=no_such_event"), http.StatusNotFound)
+	session.MakeRequest(t, NewRequest(t, "GET", link+"/item_closed"), http.StatusNotFound)
+	session.MakeRequest(t, NewRequest(t, "GET", link+"/999999"), http.StatusNotFound)
+
+	req := NewRequestWithJSON(t, "POST", link, &api.CreateProjectWorkflowOption{
+		Event:   "item_closed",
+		Actions: api.ProjectWorkflowActions{ColumnID: 3},
+	})
+	workflow := DecodeJSON(t, session.MakeRequest(t, req, http.StatusOK), &api.ProjectWorkflow{})
+	assert.Equal(t, api.ProjectWorkflowActions{ColumnID: 3}, workflow.Actions)
+	workflowLink := fmt.Sprintf("%s/%d", link, workflow.ID)
+	session.MakeRequest(t, NewRequest(t, "GET", workflowLink), http.StatusOK)
+
+	req = NewRequestWithJSON(t, "POST", workflowLink, &api.EditProjectWorkflowOption{Enabled: new(false)})
+	updated := DecodeJSON(t, session.MakeRequest(t, req, http.StatusOK), &api.ProjectWorkflow{})
+	assert.False(t, updated.Enabled)
+	assert.Equal(t, workflow.Actions, updated.Actions)
+
+	req = NewRequestWithJSON(t, "POST", link, &api.CreateProjectWorkflowOption{Event: "item_closed"})
+	resp := session.MakeRequest(t, req, http.StatusBadRequest)
+	assert.Equal(t, "At least one action must be configured", DecodeJSON(t, resp, map[string]any{})["errorMessage"])
+
+	loginUser(t, "user4").MakeRequest(t, NewRequest(t, "POST", workflowLink+"/delete"), http.StatusNotFound)
+
+	session.MakeRequest(t, NewRequest(t, "POST", workflowLink+"/delete"), http.StatusOK)
+	session.MakeRequest(t, NewRequest(t, "GET", workflowLink), http.StatusNotFound)
+}
+
+func TestProjectWorkflowExecution(t *testing.T) {
+	defer tests.PrepareTestEnv(t)()
+
+	link := "/user2/repo1/projects/1"
+	session := loginUser(t, "user2")
+
+	for _, opts := range []*api.CreateProjectWorkflowOption{{
+		Event:   "item_added_to_project",
+		Actions: api.ProjectWorkflowActions{ColumnID: 2, AddLabelIDs: []int64{1}},
+	}, {
+		Event:   "item_column_changed",
+		Actions: api.ProjectWorkflowActions{IssueState: "close"},
+	}} {
+		session.MakeRequest(t, NewRequestWithJSON(t, "POST", link+"/workflows", opts), http.StatusOK)
+	}
+
+	token := getTokenForLoggedInUser(t, session, auth_model.AccessTokenScopeWriteIssue)
+	req := NewRequestWithJSON(t, "POST", "/api/v1/repos/user2/repo1/issues", &api.CreateIssueOption{
+		Title:    "workflow item",
+		Projects: []int64{1},
+	}).AddTokenAuth(token)
+	created := DecodeJSON(t, MakeRequest(t, req, http.StatusCreated), &api.Issue{})
+
+	assert.EqualValues(t, 2, unittest.AssertExistsAndLoadBean(t, &project_model.ProjectIssue{IssueID: created.ID, ProjectID: 1}).ProjectColumnID)
+	unittest.AssertExistsAndLoadBean(t, &issues_model.IssueLabel{IssueID: created.ID, LabelID: 1})
+	assert.False(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: created.ID}).IsClosed)
+	resp := session.MakeRequest(t, NewRequestf(t, "GET", "/user2/repo1/issues/%d", created.Index), http.StatusOK)
+	assert.Contains(t, NewHTMLParser(t, resp.Body).Find(".timeline-item.event .comment-text-line").Text(), "Project workflow Item added to project")
+
+	req = NewRequestWithJSON(t, "POST", link+"/3/move", map[string]any{
+		"issues": []map[string]any{{"issueID": created.ID, "sorting": 0}},
+	})
+	session.MakeRequest(t, req, http.StatusOK)
+
+	assert.EqualValues(t, 3, unittest.AssertExistsAndLoadBean(t, &project_model.ProjectIssue{IssueID: created.ID, ProjectID: 1}).ProjectColumnID)
+	assert.True(t, unittest.AssertExistsAndLoadBean(t, &issues_model.Issue{ID: created.ID}).IsClosed)
+}