fix: update CodeBoarding dependency to 0.13.6 #214
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeBoarding review | |
| on: | |
| pull_request: | |
| # Generate once, when the PR becomes reviewable, not on every push, so we | |
| # don't spend an LLM job per commit. Add `synchronize` to re-run on each | |
| # push, or refresh anytime with /codeboarding. 'closed' only cancels an | |
| # in-flight review (see concurrency), it doesn't start one. | |
| types: [opened, reopened, ready_for_review, closed] | |
| issue_comment: | |
| types: [created] | |
| # No workflow-level permissions: the single job below requests only what it | |
| # needs (least privilege), so the default token starts with none. | |
| permissions: {} | |
| concurrency: | |
| group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }} | |
| # Cancel only when the PR closes — bot comments (issue_comment) and re-triggers | |
| # must not cancel a running review; they queue behind it instead. | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} | |
| jobs: | |
| review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| # Review mode reads the repo + committed baseline and posts a PR comment; | |
| # it does NOT commit generated files back to the branch (that is sync mode | |
| # only — see action.yml `mode` input). So contents stays read-only. | |
| contents: read | |
| pull-requests: write # post / update the architecture-diff PR comment | |
| issues: write # the /codeboarding issue_comment trigger + comment API | |
| # Never auto-review the sync mode's own baseline PR (head branch | |
| # 'codeboarding/sync', the sync_pr_branch default): it only changes generated | |
| # files, so a diff comment would be noise. Scoped to THIS repo's head so a fork | |
| # PR that merely happens to name its branch 'codeboarding/sync' is still | |
| # reviewed normally. Consumers using sync_strategy: pull_request should match | |
| # this exclusion to their sync_pr_branch and, if they run other pull_request | |
| # workflows (tests, lint), exclude the branch there too (via a head_ref guard). | |
| if: > | |
| (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false && | |
| !(github.head_ref == 'codeboarding/sync' && github.event.pull_request.head.repo.full_name == github.repository)) || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && | |
| startsWith(github.event.comment.body, '/codeboarding') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) | |
| steps: | |
| # Dogfood: run the action from the checked-out repo (uses: ./) so each PR | |
| # exercises the action code under review, not the last published release. | |
| # The action reads its scripts via github.action_path and checks the engine | |
| # and target repo into subdirectories, so this local checkout is untouched. | |
| # | |
| # On issue_comment events, checkout's default ref is the repo's DEFAULT | |
| # BRANCH (the event isn't tied to a PR), so `uses: ./` would run main's | |
| # action code, not this PR's — /codeboarding would silently test the wrong | |
| # version. Check out the PR head explicitly for that event so the comment | |
| # path dogfoods the PR under review too. pull_request events keep checkout's | |
| # default (the PR merge ref), which already points at the PR. On-demand runs | |
| # are restricted to same-repo PRs, so refs/pull/<n>/head resolves in this | |
| # repo (no fork-repo override needed). | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || '' }} | |
| - name: Detect CodeBoarding GitHub App credentials | |
| id: codeboarding-app-config | |
| shell: bash | |
| env: | |
| CLIENT_ID: ${{ vars.CODEBOARDING_APP_CLIENT_ID }} | |
| APP_ID: ${{ vars.CODEBOARDING_APP_ID }} | |
| PRIVATE_KEY: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| run: | | |
| client_id="${CLIENT_ID:-}" | |
| app_id="${APP_ID:-}" | |
| # GitHub App client IDs start with "Iv". If that value was stored in | |
| # CODEBOARDING_APP_ID, use it as a client ID to avoid the deprecated | |
| # app-id input path. | |
| if [ -z "$client_id" ] && [ "${app_id#Iv}" != "$app_id" ]; then | |
| client_id="$app_id" | |
| app_id="" | |
| fi | |
| has_private_key=false | |
| private_key_valid=false | |
| if [ -n "$PRIVATE_KEY" ]; then | |
| has_private_key=true | |
| if printf '%s' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then | |
| private_key_valid=true | |
| else | |
| echo "::warning::CODEBOARDING_APP_PRIVATE_KEY is not a valid PEM private key, so CodeBoarding will fall back to github-actions[bot]." | |
| if printf '%b' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then | |
| printf '%s\n' "::warning::CODEBOARDING_APP_PRIVATE_KEY looks like it contains literal \\n escapes. Store the downloaded PEM as multi-line secret text instead." | |
| fi | |
| fi | |
| fi | |
| { | |
| [ -n "$client_id" ] && echo "has_client_id=true" || echo "has_client_id=false" | |
| [ -n "$app_id" ] && echo "has_app_id=true" || echo "has_app_id=false" | |
| echo "client_id=$client_id" | |
| echo "has_private_key=$has_private_key" | |
| echo "private_key_valid=$private_key_valid" | |
| } >> "$GITHUB_OUTPUT" | |
| - uses: actions/create-github-app-token@v3 | |
| id: codeboarding-app-token-client | |
| if: steps.codeboarding-app-config.outputs.has_client_id == 'true' && steps.codeboarding-app-config.outputs.private_key_valid == 'true' | |
| continue-on-error: true | |
| with: | |
| client-id: ${{ steps.codeboarding-app-config.outputs.client_id }} | |
| private-key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - uses: actions/create-github-app-token@v3 | |
| id: codeboarding-app-token-app | |
| if: steps.codeboarding-app-config.outputs.has_client_id != 'true' && steps.codeboarding-app-config.outputs.has_app_id == 'true' && steps.codeboarding-app-config.outputs.private_key_valid == 'true' | |
| continue-on-error: true | |
| with: | |
| app-id: ${{ vars.CODEBOARDING_APP_ID }} | |
| private-key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - name: Warn when CodeBoarding App token is unavailable | |
| if: steps.codeboarding-app-token-client.outputs.token == '' && steps.codeboarding-app-token-app.outputs.token == '' | |
| shell: bash | |
| run: | | |
| echo "::warning::CodeBoarding GitHub App token is unavailable; falling back to github-actions[bot]. Check CODEBOARDING_APP_PRIVATE_KEY formatting if app credentials are configured." | |
| - uses: ./ | |
| with: | |
| github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }} | |
| llm_api_key: ${{ secrets.OPENROUTER_API_KEY }} |