From a30596172fc743b11c1d3b49cf63a61409db5543 Mon Sep 17 00:00:00 2001 From: Ivan Milev Date: Mon, 3 Aug 2026 14:40:25 +0200 Subject: [PATCH 1/6] Add CodeBoarding architecture analysis: add codeboarding.yml --- .github/workflows/codeboarding.yml | 38 ++++++++++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/codeboarding.yml diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml new file mode 100644 index 000000000000..367bb4e01cb9 --- /dev/null +++ b/.github/workflows/codeboarding.yml @@ -0,0 +1,38 @@ +name: CodeBoarding review + +on: + pull_request: + types: [opened, reopened, ready_for_review, closed] + issue_comment: + types: [created] + +# No workflow-level permissions: each job requests only what it needs (least +# privilege), so the default token starts with none. +permissions: {} + +concurrency: + group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }} + cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} + +jobs: + review: + runs-on: ubuntu-latest + timeout-minutes: 60 + permissions: + contents: read # check out the repo + read the committed baseline (no writes in review mode) + pull-requests: write # post the architecture-diff PR comment + issues: write # the /codeboarding issue_comment trigger + comment API + id-token: write # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token) + if: > + (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false) || + (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && + startsWith(github.event.comment.body, '/codeboarding') && + contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) + steps: + - uses: CodeBoarding/CodeBoarding-action@v1 + with: + # Free tier needs no secret — these fall through to the hosted OIDC tier when + # unset. Add either repo secret (Settings → Secrets and variables → Actions) + # for more/unmetered usage; no YAML edit required. + llm_api_key: ${{ secrets.OPENROUTER_API_KEY }} # BYO LLM provider key (OpenRouter) + license_key: ${{ secrets.CODEBOARDING_LICENSE }} # CodeBoarding paid plan From 17f7414e0e6fc3a187337e20a72060d5d2ba0e20 Mon Sep 17 00:00:00 2001 From: Ivan Milev Date: Mon, 3 Aug 2026 14:40:26 +0200 Subject: [PATCH 2/6] Add CodeBoarding architecture analysis: add codeboarding-sync.yml --- .github/workflows/codeboarding-sync.yml | 50 +++++++++++++++++++++++++ 1 file changed, 50 insertions(+) create mode 100644 .github/workflows/codeboarding-sync.yml diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml new file mode 100644 index 000000000000..3106854ea0fe --- /dev/null +++ b/.github/workflows/codeboarding-sync.yml @@ -0,0 +1,50 @@ +name: CodeBoarding sync + +on: + push: + branches: ['main'] + # Loop guard: don't re-trigger on the files this workflow itself commits. + # List generated files only: user-authored scope configuration must still trigger + # regeneration, while a merged sync PR must not trigger a loop. + paths-ignore: + - '.codeboarding/*.md' + - '.codeboarding/analysis.json' + - '.codeboarding/fingerprint.json' + - '.codeboarding/static_analysis.pkl' + - '.codeboarding/static_analysis.sha' + - '.codeboarding/codeboarding_version.json' + - '.codeboarding/health/health_report.json' + - 'docs/development/architecture.md' + workflow_dispatch: + inputs: + force_full: + description: 'Ignore the committed baseline and rebuild it from scratch (full analysis).' + type: boolean + required: false + default: false + +permissions: + contents: write # commit the generated baseline + docs to the branch + id-token: write # identifies this repo to CodeBoarding's hosted tier — used by the free + # tier AND a license, and as the fallback until your own key exists + +concurrency: + # Serialize against itself so a push landing mid-run can't make two commits. + group: codeboarding-sync + cancel-in-progress: false + +jobs: + sync: + runs-on: ubuntu-latest + timeout-minutes: 60 + steps: + - uses: CodeBoarding/CodeBoarding-action@v1 + with: + mode: sync + force_full: ${{ inputs.force_full || false }} + target_branch: 'main' + # Free tier needs no secret — these fall through to the hosted OIDC tier when + # unset. Add either repo secret (Settings → Secrets and variables → Actions) + # for more/unmetered usage; no YAML edit required. + llm_api_key: ${{ secrets.OPENROUTER_API_KEY }} # BYO LLM provider key (OpenRouter) + license_key: ${{ secrets.CODEBOARDING_LICENSE }} # CodeBoarding paid plan From 7a70b2083fcb9356b917d07478a3124705840d4e Mon Sep 17 00:00:00 2001 From: ivanmilevtues Date: Tue, 4 Aug 2026 01:07:56 +0200 Subject: [PATCH 3/6] Test CodeBoarding action PR --- .github/workflows/codeboarding-sync.yml | 2 +- .github/workflows/codeboarding.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml index 3106854ea0fe..328992c7b763 100644 --- a/.github/workflows/codeboarding-sync.yml +++ b/.github/workflows/codeboarding-sync.yml @@ -38,7 +38,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 60 steps: - - uses: CodeBoarding/CodeBoarding-action@v1 + - uses: CodeBoarding/CodeBoarding-action@refs/pull/70/head with: mode: sync force_full: ${{ inputs.force_full || false }} diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml index 367bb4e01cb9..c2c2278082f2 100644 --- a/.github/workflows/codeboarding.yml +++ b/.github/workflows/codeboarding.yml @@ -29,7 +29,7 @@ jobs: startsWith(github.event.comment.body, '/codeboarding') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) steps: - - uses: CodeBoarding/CodeBoarding-action@v1 + - uses: CodeBoarding/CodeBoarding-action@refs/pull/70/head with: # Free tier needs no secret — these fall through to the hosted OIDC tier when # unset. Add either repo secret (Settings → Secrets and variables → Actions) From 000b35875bbec025b00bffb34d43b7d0e3a2dbb1 Mon Sep 17 00:00:00 2001 From: ivanmilevtues Date: Tue, 4 Aug 2026 10:26:06 +0200 Subject: [PATCH 4/6] Configure CodeBoarding 32GB runner Amp-Thread-ID: https://ampcode.com/threads/T-019fcbb1-bdf5-76be-8cab-1a4b798b49cd Co-authored-by: Amp --- .github/workflows/codeboarding.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml index c2c2278082f2..2bfd6244ce22 100644 --- a/.github/workflows/codeboarding.yml +++ b/.github/workflows/codeboarding.yml @@ -16,7 +16,7 @@ concurrency: jobs: review: - runs-on: ubuntu-latest + runs-on: 32GB-runner timeout-minutes: 60 permissions: contents: read # check out the repo + read the committed baseline (no writes in review mode) @@ -29,7 +29,7 @@ jobs: startsWith(github.event.comment.body, '/codeboarding') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) steps: - - uses: CodeBoarding/CodeBoarding-action@refs/pull/70/head + - uses: CodeBoarding/CodeBoarding-action@v1 with: # Free tier needs no secret — these fall through to the hosted OIDC tier when # unset. Add either repo secret (Settings → Secrets and variables → Actions) From 515ea1fe091cca6513eccbecffaf7387f9a80075 Mon Sep 17 00:00:00 2001 From: Svilen Date: Tue, 4 Aug 2026 11:38:54 +0200 Subject: [PATCH 5/6] test: point the engine at the Phase-2 throughput branch Temporary, so the 60-minute review budget can be measured before release. --- .github/workflows/codeboarding.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml index 2bfd6244ce22..fd15986d3dd1 100644 --- a/.github/workflows/codeboarding.yml +++ b/.github/workflows/codeboarding.yml @@ -31,6 +31,10 @@ jobs: steps: - uses: CodeBoarding/CodeBoarding-action@v1 with: + # TEMPORARY: engine built from the Phase-2 throughput branch so the + # 60-minute budget can be measured before release. Revert to the + # action's default pin once merged. + codeboarding_version: " @ git+https://github.com/CodeBoarding/CodeBoarding.git@perf/phase2-throughput" # Free tier needs no secret — these fall through to the hosted OIDC tier when # unset. Add either repo secret (Settings → Secrets and variables → Actions) # for more/unmetered usage; no YAML edit required. From a7e463593fe4cbe8bb1df3b1fa9e8cce7465581f Mon Sep 17 00:00:00 2001 From: ivanmilevtues Date: Tue, 4 Aug 2026 11:41:25 +0200 Subject: [PATCH 6/6] Test CodeBoarding action PR in review workflow --- .github/workflows/codeboarding.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml index fd15986d3dd1..0a3ce1f54c3d 100644 --- a/.github/workflows/codeboarding.yml +++ b/.github/workflows/codeboarding.yml @@ -29,12 +29,8 @@ jobs: startsWith(github.event.comment.body, '/codeboarding') && contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) steps: - - uses: CodeBoarding/CodeBoarding-action@v1 + - uses: CodeBoarding/CodeBoarding-action@refs/pull/70/head with: - # TEMPORARY: engine built from the Phase-2 throughput branch so the - # 60-minute budget can be measured before release. Revert to the - # action's default pin once merged. - codeboarding_version: " @ git+https://github.com/CodeBoarding/CodeBoarding.git@perf/phase2-throughput" # Free tier needs no secret — these fall through to the hosted OIDC tier when # unset. Add either repo secret (Settings → Secrets and variables → Actions) # for more/unmetered usage; no YAML edit required.