Repository navigation
feat(core): showcase worktree tools and permission dependencies #8
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeBoarding | |
| on: | |
| pull_request: | |
| types: [opened, reopened, closed, synchronize] | |
| issue_comment: | |
| types: [created] | |
| # Sync keeps one branch's analysis, so this lists exactly one. There is no manual | |
| # trigger: a dispatch could run sync on any branch. | |
| push: | |
| branches: ['dev'] | |
| # No workflow-level permissions: each job requests only what it needs (least | |
| # privilege), so the default token starts with none. | |
| permissions: {} | |
| # Reviews queue per pull request, syncs per branch. Closing a pull request cancels its review. | |
| concurrency: | |
| group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number || github.ref_name }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} | |
| jobs: | |
| review: | |
| if: > | |
| (github.event_name == 'pull_request' && github.event.action != 'closed' && | |
| github.event.pull_request.head.repo.full_name == github.repository) || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && | |
| startsWith(github.event.comment.body, '/codeboarding') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: read # check out the repo + read the saved analysis (no writes in review mode) | |
| pull-requests: write # post the architecture-diff PR comment | |
| issues: write # the /codeboarding issue_comment trigger + comment API | |
| id-token: write # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token) | |
| actions: read # let a repeat review download the analysis an earlier run published, instead of re-deriving the whole PR | |
| steps: | |
| - uses: CodeBoarding/CodeBoarding-action@v1 | |
| with: | |
| # CodeBoarding's free hosted tier. No secret to add: the run authenticates | |
| # with the GitHub OIDC token that `id-token: write` above grants. | |
| llm: hosted | |
| sync: | |
| if: github.event_name == 'push' | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| contents: write # push the generated analysis to codeboarding/baseline | |
| actions: read # continue from an analysis an earlier run published | |
| id-token: write # identifies this repo to CodeBoarding's hosted tier | |
| steps: | |
| - uses: CodeBoarding/CodeBoarding-action@v1 | |
| with: | |
| mode: sync | |
| # CodeBoarding's free hosted tier. No secret to add: the run authenticates | |
| # with the GitHub OIDC token that `id-token: write` above grants. | |
| llm: hosted |