From c7495305c761022c186d1a12a614200b52c37630 Mon Sep 17 00:00:00 2001 From: Ivan Milev Date: Mon, 12 Oct 2026 02:33:37 +0200 Subject: [PATCH] Configure CodeBoarding before merge --- .github/workflows/codeboarding-review.yml | 27 --------- .github/workflows/codeboarding-sync.yml | 41 ------------- .github/workflows/codeboarding.yml | 70 +++++++++++++++++++++++ 3 files changed, 70 insertions(+), 68 deletions(-) delete mode 100644 .github/workflows/codeboarding-review.yml delete mode 100644 .github/workflows/codeboarding-sync.yml create mode 100644 .github/workflows/codeboarding.yml diff --git a/.github/workflows/codeboarding-review.yml b/.github/workflows/codeboarding-review.yml deleted file mode 100644 index 9c6e48fa..00000000 --- a/.github/workflows/codeboarding-review.yml +++ /dev/null @@ -1,27 +0,0 @@ -name: CodeBoarding review - -on: - pull_request: - types: [opened, reopened, ready_for_review] - issue_comment: - types: [created] - -permissions: - contents: read - pull-requests: write - issues: write - id-token: write - -jobs: - review: - if: > - (github.event_name == 'pull_request' && github.event.pull_request.draft == false && - github.event.pull_request.head.repo.full_name == github.repository && - github.head_ref != 'codeboarding/sync') || - (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && - startsWith(github.event.comment.body, '/codeboarding') && - contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - - uses: CodeBoarding/CodeBoarding-action@main diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml deleted file mode 100644 index 5fbf87aa..00000000 --- a/.github/workflows/codeboarding-sync.yml +++ /dev/null @@ -1,41 +0,0 @@ -name: CodeBoarding sync - -on: - push: - branches: [main] - paths-ignore: - - '.codeboarding/*.md' - - '.codeboarding/analysis.json' - - '.codeboarding/fingerprint.json' - - '.codeboarding/static_analysis.pkl' - - '.codeboarding/static_analysis.sha' - - '.codeboarding/codeboarding_version.json' - - '.codeboarding/health/health_report.json' - - 'docs/development/architecture.md' - workflow_dispatch: - inputs: - force_full: - description: Rebuild without the committed baseline - type: boolean - default: false - -permissions: - contents: write - pull-requests: write - id-token: write - -concurrency: - group: codeboarding-sync - cancel-in-progress: false - -jobs: - sync: - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - - uses: CodeBoarding/CodeBoarding-action@main - with: - mode: sync - target_branch: main - sync_strategy: pull_request - force_full: ${{ inputs.force_full || false }} diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml new file mode 100644 index 00000000..733c763e --- /dev/null +++ b/.github/workflows/codeboarding.yml @@ -0,0 +1,70 @@ +name: CodeBoarding + +on: + pull_request: + types: [opened, reopened, closed, synchronize] + issue_comment: + types: [created] + # Sync keeps one branch's analysis, so this lists exactly one. There is no manual + # trigger: a dispatch could run sync on any branch. + push: + branches: ['master'] + # Loop guard: sync commits these to master. Generated files only, so an edit to + # the user-authored configuration under .codeboarding/ still triggers a sync. + paths-ignore: + - '.codeboarding/analysis.json' + - '.codeboarding/fingerprint.json' + - '.codeboarding/static_analysis.pkl' + - '.codeboarding/static_analysis.sha' + - '.codeboarding/codeboarding_version.json' + - '.codeboarding/health/health_report.json' + +# No workflow-level permissions: each job requests only what it needs (least +# privilege), so the default token starts with none. +permissions: {} + +# Reviews queue per pull request, syncs per branch. Closing a pull request cancels its review. +concurrency: + group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || github.ref_name }} + cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} + +jobs: + review: + if: > + (github.event_name == 'pull_request' && github.event.action != 'closed' && + github.event.pull_request.head.repo.full_name == github.repository) || + (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && + startsWith(github.event.comment.body, '/codeboarding') && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read # check out the repo + read the saved analysis (no writes in review mode) + pull-requests: write # post the architecture-diff PR comment + issues: write # the /codeboarding issue_comment trigger + comment API + id-token: write # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token) + actions: read # let a repeat review download the analysis an earlier run published, instead of re-deriving the whole PR + steps: + - uses: CodeBoarding/CodeBoarding-action@refactor/review-baseline-pipeline + with: + codeboarding_analysis_location: in_place + # CodeBoarding's free hosted tier. No secret to add: the run authenticates + # with the GitHub OIDC token that `id-token: write` above grants. + llm: hosted + + sync: + if: github.event_name == 'push' + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: write # commit the generated analysis to master + actions: read # continue from an analysis an earlier run published + id-token: write # identifies this repo to CodeBoarding's hosted tier + steps: + - uses: CodeBoarding/CodeBoarding-action@refactor/review-baseline-pipeline + with: + mode: sync + codeboarding_analysis_location: in_place + # CodeBoarding's free hosted tier. No secret to add: the run authenticates + # with the GitHub OIDC token that `id-token: write` above grants. + llm: hosted