Add CodeBoarding architecture analysis - #1
Conversation
Architecture review · analyzing…⏳ CodeBoarding is analyzing the architecture changes in this PR. This usually takes a few minutes. codeboarding-action · run 30862564415 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 17f7414e0e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| runs-on: ubuntu-latest | ||
| timeout-minutes: 60 | ||
| steps: | ||
| - uses: CodeBoarding/CodeBoarding-action@v1 |
There was a problem hiding this comment.
Pin this third-party action to a full commit SHA rather than the mutable v1 tag. If that tag is moved or the upstream action is compromised, the next push can execute changed code with contents: write, OIDC-token minting, and any configured LLM/license secrets, allowing repository modification or secret exfiltration. GitHub's security guidance identifies a full-length commit SHA as the only immutable release reference; the occurrence in codeboarding.yml should be pinned as well.
Useful? React with 👍 / 👎.
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, reopened, ready_for_review, closed] |
There was a problem hiding this comment.
Add synchronize to this activity list. As configured, the analysis runs when a PR is initially opened but not when additional commits are pushed, so its architecture-diff comment and artifact become stale for the common case where a PR changes during review. GitHub's pull-request event documentation defines synchronize as the activity emitted when the PR head branch is updated.
Useful? React with 👍 / 👎.
| pull_request: | ||
| types: [opened, reopened, ready_for_review, closed] |
There was a problem hiding this comment.
For pull requests from forks, GitHub downgrades the GITHUB_TOKEN to read-only and does not pass repository secrets to workflows triggered by pull_request. Consequently, this action cannot use the requested pull-requests: write permission to post its architecture-diff comment, and configured CodeBoarding/LLM credentials are also unavailable; this repository explicitly supports fork PRs via build_target.yml, so external contributors will not receive the advertised review. Use a safe two-stage reporting workflow or a suitably scoped GitHub App rather than relying on write access in this event. See GitHub's forked-workflow restrictions.
Useful? React with 👍 / 👎.
|
Temporarily cycling this PR to trigger the CodeBoarding review workflow against CodeBoarding-action@refs/pull/70/head. |
|
/codeboarding |
1 participant
This PR adds the CodeBoarding GitHub Action via two workflows:
codeboarding-sync.yml— on every push tomain, commits.codeboarding/analysis.json(your architecture baseline + readable docs). This iswhat the CodeBoarding viewer opens.
codeboarding.yml— on every pull request, posts an architecture-diff comment anduploads that PR’s analysis as a build artifact for the viewer’s PR diff.
Both are needed: sync produces the baseline; review diffs against it.
Sync delivery
Sync commits the generated baseline directly to
main.Works out of the box
Just merge it — the Action runs on the free tier, with no extra setup. The
id-token: writepermission lets it identify your repo to CodeBoarding’s hosted LLM,metered against a weekly limit for the repository owner.
Want more, or unmetered, usage?
The workflows already wire two repository secrets — just add whichever you have under
Settings → Secrets and variables → Actions and the next run picks it up (no YAML edit):
OPENROUTER_API_KEY— your own OpenRouter key (BYO key).CODEBOARDING_LICENSE— a CodeBoarding paid plan (unmetered).A key wins if both are set; the license is used only when no key is set; with neither,
the free tier runs with nothing configured. For a non-OpenRouter provider (Anthropic,
OpenAI, Google, AWS Bedrock, …) see the
provider list, or re-run
setup from the CodeBoarding viewer and pick one.
— opened for you by CodeBoarding