Add CodeBoarding architecture analysis - #3
Conversation
CodeBoarding reviewStatus: 3 changed components See the full change in CodeBoarding. graph LR
n_Application_Hosting_Resource_Model["Application Hosting #38; Resource Model"]
n_CLI_Environment_Provisioning["CLI #38; Environment Provisioning"]
n_IDE_Extension_Developer_Tooling["IDE Extension #38; Developer Tooling"]
n_Observability_Dashboard_Terminal_Host["Observability Dashboard #38; Terminal Host"]
n_Polyglot_Type_System_Code_Generation["Polyglot Type System #38; Code Generation"]
n_Static_Analysis_Configuration_Schema["Static Analysis #38; Configuration Schema"]
n_API_Compatibility_Cross_Platform_Transport["API Compatibility #38; Cross-Platform Transport"]
n_Test_Automation_CI_Infrastructure["Test Automation #38; CI Infrastructure"]
n_Application_Hosting_Resource_Model -- "Delegates infrastructure orchestration" --> n_CLI_Environment_Provisioning
n_Application_Hosting_Resource_Model -- "Pushes resource metadata and OTLP" --> n_Observability_Dashboard_Terminal_Host
n_CLI_Environment_Provisioning -- "Bootstraps application lifecycle" --> n_Application_Hosting_Resource_Model
n_IDE_Extension_Developer_Tooling -- "Orchestrates acquisition and execution" --> n_CLI_Environment_Provisioning
n_IDE_Extension_Developer_Tooling -- "Integrates runtime UI" --> n_Observability_Dashboard_Terminal_Host
n_Polyglot_Type_System_Code_Generation -- "Scans hosting model for service references" --> n_Application_Hosting_Resource_Model
n_Static_Analysis_Configuration_Schema -- "Validates resource definitions" --> n_Application_Hosting_Resource_Model
n_API_Compatibility_Cross_Platform_Transport -- "Enforces schema consistency" --> n_Polyglot_Type_System_Code_Generation
n_Test_Automation_CI_Infrastructure -- "Exercises orchestration flows" --> n_Application_Hosting_Resource_Model
classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
class n_Application_Hosting_Resource_Model,n_CLI_Environment_Provisioning,n_IDE_Extension_Developer_Tooling modified;
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d31861b2f0
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| runs-on: ubuntu-latest | ||
| timeout-minutes: 60 | ||
| steps: | ||
| - uses: CodeBoarding/CodeBoarding-action@v1 |
There was a problem hiding this comment.
Using the mutable @v1 tag lets the action publisher retarget this workflow without any repository change. Because the sync job passes repository secrets and grants the action both contents: write and OIDC access on every push to main, a compromised or unexpectedly updated tag could exfiltrate credentials or modify the repository; pin this invocation, and the matching invocation in codeboarding.yml, to a reviewed full commit SHA.
Useful? React with 👍 / 👎.
|
|
||
| on: | ||
| pull_request: | ||
| types: [opened, reopened, ready_for_review, closed] |
There was a problem hiding this comment.
This event list never runs the review when new commits are pushed to an open PR, so the posted architecture diff and uploaded analysis remain based on the PR's initial or last-reopened revision. Include synchronize so the workflow analyzes the current head after each PR update.
Useful? React with 👍 / 👎.
| pull_request: | ||
| types: [opened, reopened, ready_for_review, closed] |
There was a problem hiding this comment.
For pull requests from public forks, GitHub downgrades the GITHUB_TOKEN to read-only and withholds repository secrets, so this job cannot use its requested pull-requests: write permission to post the architecture comment and cannot use the configured credentials. Consequently the advertised automatic review does not work for external contributors; use a safe privileged follow-up workflow for commenting and keep untrusted PR code out of that privileged context.
Useful? React with 👍 / 👎.
1 participant
This PR adds the CodeBoarding GitHub Action via two workflows:
codeboarding-sync.yml: on every push tomain, commits.codeboarding/analysis.json(your architecture baseline + readable docs). This iswhat the CodeBoarding viewer opens.
codeboarding.yml: on every pull request, posts an architecture-diff comment anduploads that PR’s analysis as a build artifact for the viewer’s PR diff.
Both are needed: sync produces the baseline; review diffs against it.
Sync delivery
Sync commits the generated baseline directly to
main.Works out of the box
Just merge it: the Action runs on the free tier, with no extra setup. The
id-token: writepermission lets it identify your repo to CodeBoarding’s hosted LLM,metered against a weekly limit for the repository owner.
Want more, or unmetered, usage?
The workflows already wire two repository secrets, so add whichever you have under
Settings → Secrets and variables → Actions and the next run picks it up (no YAML edit):
OPENROUTER_API_KEY: your own OpenRouter key (BYO key).CODEBOARDING_LICENSE: a CodeBoarding paid plan (unmetered).A key wins if both are set; the license is used only when no key is set; with neither,
the free tier runs with nothing configured. For a non-OpenRouter provider (Anthropic,
OpenAI, Google, AWS Bedrock, …) see the
provider list, or re-run
setup from your CodeBoarding dashboard and pick one.
Opened for you by CodeBoarding.