codeboarding.yml

name: CodeBoarding review

on:
  pull_request:
    types: [opened, reopened, ready_for_review, closed]
  issue_comment:
    types: [created]

# No workflow-level permissions: each job requests only what it needs (least
# privilege), so the default token starts with none.
permissions: {}

concurrency:
  group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }}
  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}

jobs:
  review:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    permissions:
      contents: read        # check out the repo + read the committed baseline (no writes in review mode)
      pull-requests: write  # post the architecture-diff PR comment
      issues: write         # the /codeboarding issue_comment trigger + comment API
      id-token: write       # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token)
    if: >
      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false) ||
      (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
       startsWith(github.event.comment.body, '/codeboarding') &&
       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
    steps:
      - uses: CodeBoarding/CodeBoarding-action@v1
        with:
          # Free tier needs no secret — these fall through to the hosted OIDC tier when
          # unset. Add either repo secret (Settings → Secrets and variables → Actions)
          # for more/unmetered usage; no YAML edit required.
          llm_api_key: ${{ secrets.OPENROUTER_API_KEY }}   # BYO LLM provider key (OpenRouter)
          license_key: ${{ secrets.CODEBOARDING_LICENSE }}  # CodeBoarding paid plan