From 2b509935be9df716f4498a38c7291861fa43a717 Mon Sep 17 00:00:00 2001 From: Ivan Milev Date: Sun, 11 Oct 2026 11:29:34 +0200 Subject: [PATCH] Update CodeBoarding workflow configuration --- .github/workflows/codeboarding-review.yml | 37 ------------ .github/workflows/codeboarding-sync.yml | 50 ---------------- .github/workflows/codeboarding.yml | 70 +++++++++++++++++++++++ 3 files changed, 70 insertions(+), 87 deletions(-) delete mode 100644 .github/workflows/codeboarding-review.yml delete mode 100644 .github/workflows/codeboarding-sync.yml create mode 100644 .github/workflows/codeboarding.yml diff --git a/.github/workflows/codeboarding-review.yml b/.github/workflows/codeboarding-review.yml deleted file mode 100644 index 5335d44fb..000000000 --- a/.github/workflows/codeboarding-review.yml +++ /dev/null @@ -1,37 +0,0 @@ -name: CodeBoarding review - -on: - pull_request: - types: [opened, reopened, ready_for_review, synchronize] - issue_comment: - types: [created] - -permissions: - contents: read - actions: read - pull-requests: write - issues: write - id-token: write - -concurrency: - group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }} - cancel-in-progress: false - -jobs: - review: - if: > - (github.event_name == 'pull_request' && github.event.pull_request.draft == false && - github.event.pull_request.head.repo.full_name == github.repository) || - (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && - startsWith(github.event.comment.body, '/codeboarding') && - contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - # Keep the action ref, provider, and depth aligned with codeboarding-sync.yml - # so reviews reuse the graph published by sync instead of rebuilding it. - - uses: CodeBoarding/CodeBoarding-action@v1 - with: - mode: review - llm: hosted - depth_cap: 2 diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml deleted file mode 100644 index 2e92d7ebc..000000000 --- a/.github/workflows/codeboarding-sync.yml +++ /dev/null @@ -1,50 +0,0 @@ -name: CodeBoarding sync - -on: - push: - branches: ['main'] - # Loop guard: don't re-trigger on the files this workflow itself commits. - # List generated files only: user-authored scope configuration must still trigger - # regeneration, while a merged sync PR must not trigger a loop. - paths-ignore: - - '.codeboarding/*.md' - - '.codeboarding/analysis.json' - - '.codeboarding/fingerprint.json' - - '.codeboarding/static_analysis.pkl' - - '.codeboarding/static_analysis.sha' - - '.codeboarding/codeboarding_version.json' - - '.codeboarding/health/health_report.json' - - 'docs/development/architecture.md' - workflow_dispatch: - inputs: - force_full: - description: 'Ignore the committed baseline and rebuild it from scratch (full analysis).' - type: boolean - required: false - default: false - -permissions: - contents: write # commit the generated baseline + docs to the branch - id-token: write # identifies this repo to CodeBoarding's hosted tier, used by the free - # tier AND a license, and as the fallback until your own key exists - -concurrency: - # Serialize against itself so a push landing mid-run can't make two commits. - group: codeboarding-sync - cancel-in-progress: false - -jobs: - sync: - runs-on: ubuntu-latest - timeout-minutes: 60 - steps: - # Keep the action ref, provider, and depth aligned with codeboarding-review.yml. - - uses: CodeBoarding/CodeBoarding-action@v1 - with: - mode: sync - depth_cap: 2 - force_full: ${{ inputs.force_full || false }} - target_branch: 'main' - # CodeBoarding's free hosted tier. No secret to add: the run authenticates - # with the GitHub OIDC token that `id-token: write` above grants. - llm: hosted diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml new file mode 100644 index 000000000..c076626d2 --- /dev/null +++ b/.github/workflows/codeboarding.yml @@ -0,0 +1,70 @@ +name: CodeBoarding + +on: + pull_request: + types: [opened, reopened, closed, synchronize] + issue_comment: + types: [created] + # Sync keeps one branch's analysis, so this lists exactly one. There is no manual + # trigger: a dispatch could run sync on any branch. + push: + branches: ['main'] + # Loop guard: sync commits these to main. Generated files only, so an edit to + # the user-authored configuration under .codeboarding/ still triggers a sync. + paths-ignore: + - '.codeboarding/analysis.json' + - '.codeboarding/fingerprint.json' + - '.codeboarding/static_analysis.pkl' + - '.codeboarding/static_analysis.sha' + - '.codeboarding/codeboarding_version.json' + - '.codeboarding/health/health_report.json' + +# No workflow-level permissions: each job requests only what it needs (least +# privilege), so the default token starts with none. +permissions: {} + +# Reviews queue per pull request, syncs per branch. Closing a pull request cancels its review. +concurrency: + group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || github.ref_name }} + cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} + +jobs: + review: + if: > + (github.event_name == 'pull_request' && github.event.action != 'closed' && + github.event.pull_request.head.repo.full_name == github.repository) || + (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && + startsWith(github.event.comment.body, '/codeboarding') && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read # check out the repo + read the saved analysis (no writes in review mode) + pull-requests: write # post the architecture-diff PR comment + issues: write # the /codeboarding issue_comment trigger + comment API + id-token: write # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token) + actions: read # let a repeat review download the analysis an earlier run published, instead of re-deriving the whole PR + steps: + - uses: CodeBoarding/CodeBoarding-action@v1 + with: + codeboarding_analysis_location: in_place + # CodeBoarding's free hosted tier. No secret to add: the run authenticates + # with the GitHub OIDC token that `id-token: write` above grants. + llm: hosted + + sync: + if: github.event_name == 'push' + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: write # commit the generated analysis to main + actions: read # continue from an analysis an earlier run published + id-token: write # identifies this repo to CodeBoarding's hosted tier + steps: + - uses: CodeBoarding/CodeBoarding-action@v1 + with: + mode: sync + codeboarding_analysis_location: in_place + # CodeBoarding's free hosted tier. No secret to add: the run authenticates + # with the GitHub OIDC token that `id-token: write` above grants. + llm: hosted