From ee21c18a5d1e87e6cd978ba10a067f25b22a4496 Mon Sep 17 00:00:00 2001
From: Ivan Milev <ivanmilevtues@gmail.com>
Date: Tue, 28 Jul 2026 23:03:19 +0200
Subject: [PATCH 1/2] Add CodeBoarding architecture analysis: add
 codeboarding.yml

---
 .github/workflows/codeboarding.yml | 39 ++++++++++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 .github/workflows/codeboarding.yml

diff --git a/.github/workflows/codeboarding.yml b/.github/workflows/codeboarding.yml
new file mode 100644
index 0000000..c66173b
--- /dev/null
+++ b/.github/workflows/codeboarding.yml
@@ -0,0 +1,39 @@
+name: CodeBoarding review
+
+on:
+  pull_request:
+    types: [opened, reopened, ready_for_review, closed]
+  issue_comment:
+    types: [created]
+
+# No workflow-level permissions: each job requests only what it needs (least
+# privilege), so the default token starts with none.
+permissions: {}
+
+concurrency:
+  group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }}
+
+jobs:
+  review:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    permissions:
+      contents: read        # check out the repo + read the committed baseline (no writes in review mode)
+      pull-requests: write  # post the architecture-diff PR comment
+      issues: write         # the /codeboarding issue_comment trigger + comment API
+      id-token: write       # mint a GitHub OIDC token for the free hosted tier (write is the only level for id-token)
+    if: >
+      (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false &&
+       github.head_ref != 'codeboarding/sync') ||
+      (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
+       startsWith(github.event.comment.body, '/codeboarding') &&
+       contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
+    steps:
+      - uses: CodeBoarding/CodeBoarding-action@v1
+        with:
+          # Free tier needs no secret — these fall through to the hosted OIDC tier when
+          # unset. Add either repo secret (Settings → Secrets and variables → Actions)
+          # for more/unmetered usage; no YAML edit required.
+          llm_api_key: ${{ secrets.OPENROUTER_API_KEY }}   # BYO LLM provider key (OpenRouter)
+          license_key: ${{ secrets.CODEBOARDING_LICENSE }}  # CodeBoarding paid plan

From b2660cf31f1cd0f39b9c99b97004139abb866bfd Mon Sep 17 00:00:00 2001
From: Ivan Milev <ivanmilevtues@gmail.com>
Date: Tue, 28 Jul 2026 23:03:20 +0200
Subject: [PATCH 2/2] Add CodeBoarding architecture analysis: add
 codeboarding-sync.yml

---
 .github/workflows/codeboarding-sync.yml | 52 +++++++++++++++++++++++++
 1 file changed, 52 insertions(+)
 create mode 100644 .github/workflows/codeboarding-sync.yml

diff --git a/.github/workflows/codeboarding-sync.yml b/.github/workflows/codeboarding-sync.yml
new file mode 100644
index 0000000..809f498
--- /dev/null
+++ b/.github/workflows/codeboarding-sync.yml
@@ -0,0 +1,52 @@
+name: CodeBoarding sync
+
+on:
+  push:
+    branches: ['main']
+    # Loop guard: don't re-trigger on the files this workflow itself commits.
+    # List generated files only: user-authored scope configuration must still trigger
+    # regeneration, while a merged sync PR must not trigger a loop.
+    paths-ignore:
+      - '.codeboarding/*.md'
+      - '.codeboarding/analysis.json'
+      - '.codeboarding/fingerprint.json'
+      - '.codeboarding/static_analysis.pkl'
+      - '.codeboarding/static_analysis.sha'
+      - '.codeboarding/codeboarding_version.json'
+      - '.codeboarding/health/health_report.json'
+      - 'docs/development/architecture.md'
+  workflow_dispatch:
+    inputs:
+      force_full:
+        description: 'Ignore the committed baseline and rebuild it from scratch (full analysis).'
+        type: boolean
+        required: false
+        default: false
+
+permissions:
+  contents: write   # commit the generated baseline + docs to the branch
+  pull-requests: write # open/update the rolling baseline PR for a protected target branch
+  id-token: write   # identifies this repo to CodeBoarding's hosted tier — used by the free
+                    # tier AND a license, and as the fallback until your own key exists
+
+concurrency:
+  # Serialize against itself so a push landing mid-run can't make two commits.
+  group: codeboarding-sync
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    timeout-minutes: 60
+    steps:
+      - uses: CodeBoarding/CodeBoarding-action@v1
+        with:
+          mode: sync
+          force_full: ${{ inputs.force_full || false }}
+          sync_strategy: pull_request
+          target_branch: 'main'
+          # Free tier needs no secret — these fall through to the hosted OIDC tier when
+          # unset. Add either repo secret (Settings → Secrets and variables → Actions)
+          # for more/unmetered usage; no YAML edit required.
+          llm_api_key: ${{ secrets.OPENROUTER_API_KEY }}   # BYO LLM provider key (OpenRouter)
+          license_key: ${{ secrets.CODEBOARDING_LICENSE }}  # CodeBoarding paid plan