eShop/.github/workflows/codeboarding.yml at main · CodeBoarding/eShop · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
name: CodeBoarding

on:
  pull_request:
    types: [opened, reopened, closed, synchronize]
  issue_comment:
    types: [created]
  # Sync keeps one branch's analysis, so this lists exactly one. There is no manual
  # trigger: a dispatch could run sync on any branch.
  push:
    branches: ['main']
    # Loop guard: sync commits these to main. Generated files only, so an edit to
    # the user-authored configuration under .codeboarding/ still triggers a sync.
    paths-ignore:
      - '.codeboarding/analysis.json'
      - '.codeboarding/fingerprint.json'
      - '.codeboarding/static_analysis.pkl'
      - '.codeboarding/static_analysis.sha'
      - '.codeboarding/codeboarding_version.json'
      - '.codeboarding/health/health_report.json'

# No workflow-level permissions: each job requests only what it needs (least
# privilege), so the default token starts with none.
permissions: {}

# Reviews queue per pull request, syncs per branch. Closing a pull request cancels its review.
concurrency:
  group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || github.ref_name }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}

jobs:
  review:
    if: >
      (github.event_name == 'pull_request' && github.event.action != 'closed' &&
       github.event.pull_request.head.repo.full_name == github.repository) ||
      (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
       startsWith(github.event.comment.body, '/codeboarding') &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read        # check out the repo + read the saved analysis (no writes in review mode)
      pull-requests: write  # post the architecture-diff PR comment
      issues: write         # the /codeboarding issue_comment trigger + comment API
      id-token: write       # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token)
      actions: read         # let a repeat review download the analysis an earlier run published, instead of re-deriving the whole PR
    steps:
      - uses: CodeBoarding/CodeBoarding-action@v1
        with:
          codeboarding_analysis_location: in_place
          # CodeBoarding's free hosted tier. No secret to add: the run authenticates
          # with the GitHub OIDC token that `id-token: write` above grants.
          llm: hosted

  sync:
    if: github.event_name == 'push'
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: write       # commit the generated analysis to main
      actions: read         # continue from an analysis an earlier run published
      id-token: write       # identifies this repo to CodeBoarding's hosted tier
    steps:
      - uses: CodeBoarding/CodeBoarding-action@v1
        with:
          mode: sync
          codeboarding_analysis_location: in_place
          # CodeBoarding's free hosted tier. No secret to add: the run authenticates
          # with the GitHub OIDC token that `id-token: write` above grants.
          llm: hosted