Update CodeBoarding workflow configuration

.github/workflows/codeboarding.yml

@@ -0,0 +1,70 @@
+name: CodeBoarding
+
+on:
+  pull_request:
+    types: [opened, reopened, closed, synchronize]
+  issue_comment:
+    types: [created]
+  # Sync keeps one branch's analysis, so this lists exactly one. There is no manual
+  # trigger: a dispatch could run sync on any branch.
+  push:
+    branches: ['main']
+    # Loop guard: sync commits these to main. Generated files only, so an edit to
+    # the user-authored configuration under .codeboarding/ still triggers a sync.
+    paths-ignore:
+      - '.codeboarding/analysis.json'
+      - '.codeboarding/fingerprint.json'
+      - '.codeboarding/static_analysis.pkl'
+      - '.codeboarding/static_analysis.sha'
+      - '.codeboarding/codeboarding_version.json'
+      - '.codeboarding/health/health_report.json'
+
+# No workflow-level permissions: each job requests only what it needs (least
+# privilege), so the default token starts with none.
+permissions: {}
+
+# Reviews queue per pull request, syncs per branch. Closing a pull request cancels its review.
+concurrency:
+  group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || github.ref_name }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}
+
+jobs:
+  review:
+    if: >
+      (github.event_name == 'pull_request' && github.event.action != 'closed' &&
+       github.event.pull_request.head.repo.full_name == github.repository) ||
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
+       startsWith(github.event.comment.body, '/codeboarding') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read        # check out the repo + read the saved analysis (no writes in review mode)
+      pull-requests: write  # post the architecture-diff PR comment
+      issues: write         # the /codeboarding issue_comment trigger + comment API
+      id-token: write       # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token)
+      actions: read         # let a repeat review download the analysis an earlier run published, instead of re-deriving the whole PR
+    steps:
+      - uses: CodeBoarding/CodeBoarding-action@v1
+        with:
+          codeboarding_analysis_location: in_place
+          # CodeBoarding's free hosted tier. No secret to add: the run authenticates
+          # with the GitHub OIDC token that `id-token: write` above grants.
+          llm: hosted
+
+  sync:
+    if: github.event_name == 'push'
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: write       # commit the generated analysis to main
+      actions: read         # continue from an analysis an earlier run published
+      id-token: write       # identifies this repo to CodeBoarding's hosted tier
+    steps:
+      - uses: CodeBoarding/CodeBoarding-action@v1
+        with:
+          mode: sync
+          codeboarding_analysis_location: in_place
+          # CodeBoarding's free hosted tier. No secret to add: the run authenticates
+          # with the GitHub OIDC token that `id-token: write` above grants.
+          llm: hosted