fix: stop discarding the health report #258
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CodeBoarding review | |
| on: | |
| pull_request: | |
| # Generate once, when the PR becomes reviewable. Reusing this PR's previous | |
| # analysis makes per-push runs affordable, so `synchronize` is a reasonable | |
| # addition now; /codeboarding still refreshes on demand. 'closed' only | |
| # cancels an in-flight review (see concurrency), it doesn't start one. | |
| types: [opened, reopened, ready_for_review, closed] | |
| issue_comment: | |
| types: [created] | |
| # No workflow-level permissions: the single job below requests only what it | |
| # needs (least privilege), so the default token starts with none. | |
| permissions: {} | |
| concurrency: | |
| group: codeboarding-${{ github.event.pull_request.number || github.event.issue.number }} | |
| # Cancel only when the PR closes — bot comments (issue_comment) and re-triggers | |
| # must not cancel a running review; they queue behind it instead. | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' && github.event.action == 'closed' }} | |
| jobs: | |
| review: | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 60 | |
| permissions: | |
| # Review mode reads the repo + committed baseline and posts a PR comment; | |
| # it does NOT commit generated files back to the branch (that is sync mode | |
| # only — see action.yml `mode` input). So contents stays read-only. | |
| contents: read | |
| pull-requests: write # post / update the architecture-diff PR comment | |
| issues: write # the /codeboarding issue_comment trigger + comment API | |
| id-token: write # mint per-request OIDC credentials for the relay | |
| # Never auto-review the fixed machine-owned 'codeboarding/sync' PR: it only | |
| # changes generated files, so a diff comment would be noise. Scope this to | |
| # this repository so a fork using the same branch name is still reviewed. | |
| if: > | |
| (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false && | |
| github.event.pull_request.head.repo.full_name == github.repository && | |
| !(github.head_ref == 'codeboarding/sync' && github.event.pull_request.head.repo.full_name == github.repository)) || | |
| (github.event_name == 'issue_comment' && github.event.issue.pull_request != null && | |
| startsWith(github.event.comment.body, '/codeboarding') && | |
| contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association)) | |
| steps: | |
| # Automatic same-repo reviews dogfood the PR action. Slash commands use the | |
| # trusted default-branch action, which can safely analyze a fork's head | |
| # without executing its action.yml with this job's OIDC permission. | |
| - uses: actions/checkout@v4 | |
| with: | |
| ref: ${{ github.event_name == 'issue_comment' && github.event.repository.default_branch || '' }} | |
| - name: Detect CodeBoarding GitHub App credentials | |
| id: codeboarding-app-config | |
| shell: bash | |
| env: | |
| CLIENT_ID: ${{ vars.CODEBOARDING_APP_CLIENT_ID }} | |
| APP_ID: ${{ vars.CODEBOARDING_APP_ID }} | |
| PRIVATE_KEY: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| run: | | |
| client_id="${CLIENT_ID:-}" | |
| app_id="${APP_ID:-}" | |
| # GitHub App client IDs start with "Iv". If that value was stored in | |
| # CODEBOARDING_APP_ID, use it as a client ID to avoid the deprecated | |
| # app-id input path. | |
| if [ -z "$client_id" ] && [ "${app_id#Iv}" != "$app_id" ]; then | |
| client_id="$app_id" | |
| app_id="" | |
| fi | |
| has_private_key=false | |
| private_key_valid=false | |
| if [ -n "$PRIVATE_KEY" ]; then | |
| has_private_key=true | |
| if printf '%s' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then | |
| private_key_valid=true | |
| else | |
| echo "::warning::CODEBOARDING_APP_PRIVATE_KEY is not a valid PEM private key, so CodeBoarding will fall back to github-actions[bot]." | |
| if printf '%b' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then | |
| printf '%s\n' "::warning::CODEBOARDING_APP_PRIVATE_KEY looks like it contains literal \\n escapes. Store the downloaded PEM as multi-line secret text instead." | |
| fi | |
| fi | |
| fi | |
| { | |
| [ -n "$client_id" ] && echo "has_client_id=true" || echo "has_client_id=false" | |
| [ -n "$app_id" ] && echo "has_app_id=true" || echo "has_app_id=false" | |
| echo "client_id=$client_id" | |
| echo "has_private_key=$has_private_key" | |
| echo "private_key_valid=$private_key_valid" | |
| } >> "$GITHUB_OUTPUT" | |
| - uses: actions/create-github-app-token@v3 | |
| id: codeboarding-app-token-client | |
| if: steps.codeboarding-app-config.outputs.has_client_id == 'true' && steps.codeboarding-app-config.outputs.private_key_valid == 'true' | |
| continue-on-error: true | |
| with: | |
| client-id: ${{ steps.codeboarding-app-config.outputs.client_id }} | |
| private-key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - uses: actions/create-github-app-token@v3 | |
| id: codeboarding-app-token-app | |
| if: steps.codeboarding-app-config.outputs.has_client_id != 'true' && steps.codeboarding-app-config.outputs.has_app_id == 'true' && steps.codeboarding-app-config.outputs.private_key_valid == 'true' | |
| continue-on-error: true | |
| with: | |
| app-id: ${{ vars.CODEBOARDING_APP_ID }} | |
| private-key: ${{ secrets.CODEBOARDING_APP_PRIVATE_KEY }} | |
| - name: Warn when CodeBoarding App token is unavailable | |
| if: steps.codeboarding-app-token-client.outputs.token == '' && steps.codeboarding-app-token-app.outputs.token == '' | |
| shell: bash | |
| run: | | |
| echo "::warning::CodeBoarding GitHub App token is unavailable; falling back to github-actions[bot]. Check CODEBOARDING_APP_PRIVATE_KEY formatting if app credentials are configured." | |
| - uses: ./ | |
| with: | |
| github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }} |