Asana

When a pull request links to an Asana task, MergeHarbor reads the task and checks the change against its acceptance criteria, like it does for Jira and Linear issues.

What it does in reviews

• Finds the tasks a pull request refers to. Asana task links in the pull request title, description and commit messages (app.asana.com/0/<project>/<task>, app.asana.com/1/<workspace>/task/<task> and the project-scoped form), and branch names such as asana-1209876543210. Only linked tasks are read.
• Reads the task. Name, notes, status (completed, or its section) and custom fields. Acceptance criteria come from an “Acceptance criteria” or “Definition of done” section or checklist in the notes, and from custom fields with those names; other custom fields are added to the task’s description for context.
• Checks the change against it. The review’s requirements check reports each criterion as met, not met or unclear, with evidence from the diff. Text that looks like a secret is redacted before it reaches the model. No extra model call is made.
• Optionally comments on the task. With Comment on linked issues on, MergeHarbor keeps one comment on each linked task up to date after every review: findings, confidence and requirements met, with a link to the review.

Connect

1. In the console, open Integrations and choose Connect on Asana (under Issue tracking). You need the settings.manage permission.
2. Sign in to Asana and allow access. MergeHarbor asks only to read tasks, projects, users and workspaces. To let it comment on tasks, turn on Comment on linked issues in Settings; you are asked to reconnect and grant comment permission.
3. Choose Test connection.

What is read and stored

• Task name, link, status, notes and custom fields, cached for a short time (10 minutes by default), deleted within 24 hours, and never written to logs. Linked tasks on a pull request keep only their link, status and the requirements check. If an administrator turns on Keep linked documents in the knowledge base, text that issue triage reads is kept for the days they choose (1–365) after last use instead.
• Tokens are encrypted at rest and never shown again. In Settings, you can limit the integration to some repositories.

Disconnect

Open the integration in Integrations and choose Disconnect. MergeHarbor revokes its token with Asana and deletes its tokens and cached tasks. Comments it posted stay on the tasks.

Self-hosted installations

Create an app in the Asana developer console (step by step in docs/OAUTH_APPS.md, “Asana connections”): add the redirect URL {PUBLIC_URL}/integrations/connect/asana/callback and the permission scopes tasks:read, projects:read, users:read, workspaces:read, custom_fields:read and stories:write, then set ASANA_OAUTH_CLIENT_ID and ASANA_OAUTH_CLIENT_SECRET. Asana stays hidden in the console until both are set.