Repository navigation
feat: save the default branch's analysis to a branch of its own, and generate the review's base in a step of its own #498
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # Dogfood: this repository reviews its pull requests and keeps its own baseline | |
| # current with the action checked out here (uses: ./), so every change exercises | |
| # the action code on that ref rather than the last published release. | |
| # | |
| # review pull requests and /codeboarding comments | |
| # sync pushes to main, and manual runs (workflow_dispatch) | |
| name: CodeBoarding | |
| on: | |
| pull_request: | |
| # Analyze when the PR opens or receives a commit, whether it is ready or draft. | |
| # Changing only the draft state does not rerun analysis. 'closed' only cancels | |
| # an in-flight review (see concurrency), it doesn't start one. | |
| types: [opened, reopened, closed, synchronize] | |
| issue_comment: | |
| types: [created] | |
| push: | |
| branches: [main] | |
| # Loop guard: don't re-trigger on the files sync itself commits to main. | |
| # This list must name EVERY generated artifact (an un-ignored one leaks the | |
| # bot's own commit through and re-triggers), and must name ONLY generated | |
| # artifacts — never a user-authored input, whose edit changes analysis scope | |
| # and must regenerate the baseline. So: deliberately NOT '.codeboarding/**' | |
| # (would swallow .codeboarding/.codeboardingignore) and NOT | |
| # '.codeboarding/health/**' (would swallow the user-authored health/.healthignore | |
| # and health/health_config.json) — only the generated health/health_report.json | |
| # is listed. The action also skips re-analyzing its own commit by author email | |
| # as a backstop. The bot commit uses no [skip ci] (that would leak through | |
| # squash-merges and skip real merges). | |
| paths-ignore: | |
| - '.codeboarding/analysis.json' | |
| - '.codeboarding/fingerprint.json' | |
| - '.codeboarding/static_analysis.pkl' | |
| - '.codeboarding/static_analysis.sha' | |
| - '.codeboarding/codeboarding_version.json' | |
| - '.codeboarding/health/health_report.json' | |
| workflow_dispatch: | |
| inputs: | |
| force_full: | |
| description: 'Ignore the saved baseline and rebuild it from scratch (full analysis).' | |
| type: boolean | |
| required: false | |
| default: false | |
| # No workflow-level permissions: each job requests only what it needs (least | |
| # privilege), so the default token starts with none. | |
| permissions: {} | |
| # Workflow-level, not per job: a 'closed' run skips the review job, and only a run | |
| # that joins the group can cancel the review still in flight. | |
| # review one group per pull request; queue, and cancel only when the PR closes — | |
| # bot comments (issue_comment) and re-triggers must not cancel a running | |
| # review, they queue behind it instead. | |
| # sync one group for every baseline writer: a push landing while a manual | |
| # dispatch is mid-run must not produce two concurrent commits to main. | |
| concurrency: | |
| group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || 'baseline-writers' }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} | |
| jobs: | |
| review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| # Review mode reads the repo + committed baseline and posts a PR comment; | |
| # it does NOT commit generated files back to the branch (that is the sync | |
| # job below). So contents stays read-only. | |
| contents: read | |
| actions: read # download the analysis an earlier run published | |
| pull-requests: write # post / update the architecture-diff PR comment | |
| issues: write # the /codeboarding issue_comment trigger + comment API | |
| id-token: write # mint per-request OIDC credentials for the relay | |
| if: > | |
| (github.event_name == 'pull_request' && github.event.action != 'closed' && | |
| github.event.pull_request.head.repo.full_name == github.repository) || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && | |
| startsWith(github.event.comment.body, '/codeboarding') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) | |
| steps: | |
| # Automatic same-repo reviews dogfood the PR action. Slash commands use the | |
| # trusted default-branch action, which can safely analyze a fork's head | |
| # without executing its action.yml with this job's OIDC permission. | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event_name == 'issue_comment' && github.event.repository.default_branch || '' }} | |
| - uses: ./.github/actions/app-token | |
| id: app | |
| with: | |
| client_id: ${{ vars.CODEBOARDING_APP_CLIENT_ID }} | |
| app_id: ${{ vars.CODEBOARDING_APP_ID }} | |
| private_key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - uses: ./ | |
| with: | |
| # Named, not inferred: the action refuses to guess where credentials come | |
| # from, so every workflow says which of hosted / license / a provider it | |
| # wants. CodeBoarding's own repositories run on the CodeBoarding plan. | |
| llm: license | |
| license_key: ${{ secrets.CODEBOARDING_LICENSE }} | |
| # This repository commits its analysis to main, so reviews read it there. | |
| codeboarding_analysis_branch: main | |
| github_token: ${{ steps.app.outputs.token || github.token }} | |
| # The ONLY baseline writer for this repository. The manual "rebuild from | |
| # scratch" path is workflow_dispatch + force_full, which runs the same tested | |
| # action instead of a hand-rolled copy of its pipeline. | |
| sync: | |
| if: github.event_name == 'push' || github.event_name == 'workflow_dispatch' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: write # push the generated baseline | |
| actions: read # catch up from an analysis a review saved | |
| id-token: write # mint per-request OIDC credentials for the relay | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: ./.github/actions/app-token | |
| id: app | |
| with: | |
| client_id: ${{ vars.CODEBOARDING_APP_CLIENT_ID }} | |
| app_id: ${{ vars.CODEBOARDING_APP_ID }} | |
| private_key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - uses: ./ | |
| with: | |
| mode: sync | |
| llm: license | |
| license_key: ${{ secrets.CODEBOARDING_LICENSE }} | |
| # Must match the review job above, which reads it. | |
| codeboarding_analysis_branch: main | |
| force_full: ${{ inputs.force_full || false }} | |
| # The App token attributes the baseline commit to the CodeBoarding App. | |
| # The workflow token can push too, since this job grants contents: write. | |
| github_token: ${{ steps.app.outputs.token || github.token }} |