CodeBoarding
diff --git a/‎.github/workflows/codeboarding-sync.yml‎
Lines changed: 3 additions & 13 deletions b/‎.github/workflows/codeboarding-sync.yml‎
Lines changed: 3 additions & 13 deletions
diff --git a/‎.github/workflows/codeboarding.yml‎
Lines changed: 9 additions & 22 deletions b/‎.github/workflows/codeboarding.yml‎
Lines changed: 9 additions & 22 deletions
@@ -47,11 +47,6 @@ on:
         options: [push, pull_request]
         required: false
         default: push
-      sync_pr_branch:
-        description: 'Machine-owned branch used when sync_strategy is pull_request.'
-        type: string
-        required: false
-        default: codeboarding/sync
 
 # No workflow-level permissions: the single job below requests only what it
 # needs (least privilege), so the default token starts with none.
@@ -70,6 +65,7 @@ jobs:
     permissions:
       contents: write       # push the generated baseline branch
       pull-requests: write  # workflow_dispatch may exercise pull_request delivery
+      id-token: write       # mint per-request OIDC credentials for the relay
     steps:
       # Dogfood: run the action from the checked-out repo (uses: ./) so pushes to
       # main exercise the action code on main, not the last published release.
@@ -145,15 +141,9 @@ jobs:
       - uses: ./
         with:
           mode: sync
-          force_full: ${{ inputs.force_full || false }}
-          # Push events retain direct delivery to their branch. A manual
-          # pull_request-strategy run targets main even though the workflow code
-          # itself is checked out from the feature ref being dogfooded.
-          target_branch: ${{ github.event_name == 'workflow_dispatch' && inputs.sync_strategy == 'pull_request' && 'main' || github.ref_name }}
           sync_strategy: ${{ inputs.sync_strategy || 'push' }}
-          sync_pr_branch: ${{ inputs.sync_pr_branch || 'codeboarding/sync' }}
+          force_full: ${{ inputs.force_full || false }}
           # App token authenticates the baseline push so the commit is attributed
           # to the CodeBoarding App (logo avatar). Falls back to the workflow token,
           # which can push because this job grants contents: write.
-          push_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }}
-          llm_api_key: ${{ secrets.OPENROUTER_API_KEY }}
+          github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }}
@@ -31,36 +31,24 @@ jobs:
       contents: read
       pull-requests: write  # post / update the architecture-diff PR comment
       issues: write         # the /codeboarding issue_comment trigger + comment API
-    # Never auto-review the sync mode's own baseline PR (head branch
-    # 'codeboarding/sync', the sync_pr_branch default): it only changes generated
-    # files, so a diff comment would be noise. Scoped to THIS repo's head so a fork
-    # PR that merely happens to name its branch 'codeboarding/sync' is still
-    # reviewed normally. Consumers using sync_strategy: pull_request should match
-    # this exclusion to their sync_pr_branch and, if they run other pull_request
-    # workflows (tests, lint), exclude the branch there too (via a head_ref guard).
+      id-token: write       # mint per-request OIDC credentials for the relay
+    # Never auto-review the fixed machine-owned 'codeboarding/sync' PR: it only
+    # changes generated files, so a diff comment would be noise. Scope this to
+    # this repository so a fork using the same branch name is still reviewed.
     if: >
       (github.event_name == 'pull_request' && github.event.action != 'closed' && github.event.pull_request.draft == false &&
+       github.event.pull_request.head.repo.full_name == github.repository &&
        !(github.head_ref == 'codeboarding/sync' && github.event.pull_request.head.repo.full_name == github.repository)) ||
       (github.event_name == 'issue_comment' && github.event.issue.pull_request != null &&
        startsWith(github.event.comment.body, '/codeboarding') &&
        contains(fromJSON('["OWNER","MEMBER","COLLABORATOR"]'), github.event.comment.author_association))
     steps:
-      # Dogfood: run the action from the checked-out repo (uses: ./) so each PR
-      # exercises the action code under review, not the last published release.
-      # The action reads its scripts via github.action_path and checks the engine
-      # and target repo into subdirectories, so this local checkout is untouched.
-      #
-      # On issue_comment events, checkout's default ref is the repo's DEFAULT
-      # BRANCH (the event isn't tied to a PR), so `uses: ./` would run main's
-      # action code, not this PR's — /codeboarding would silently test the wrong
-      # version. Check out the PR head explicitly for that event so the comment
-      # path dogfoods the PR under review too. pull_request events keep checkout's
-      # default (the PR merge ref), which already points at the PR. On-demand runs
-      # are restricted to same-repo PRs, so refs/pull/<n>/head resolves in this
-      # repo (no fork-repo override needed).
+      # Automatic same-repo reviews dogfood the PR action. Slash commands use the
+      # trusted default-branch action, which can safely analyze a fork's head
+      # without executing its action.yml with this job's OIDC permission.
       - uses: actions/checkout@v4
         with:
-          ref: ${{ github.event_name == 'issue_comment' && format('refs/pull/{0}/head', github.event.issue.number) || '' }}
+          ref: ${{ github.event_name == 'issue_comment' && github.event.repository.default_branch || '' }}
       - name: Detect CodeBoarding GitHub App credentials
         id: codeboarding-app-config
         shell: bash
@@ -123,4 +111,3 @@ jobs:
       - uses: ./
         with:
           github_token: ${{ steps.codeboarding-app-token-client.outputs.token || steps.codeboarding-app-token-app.outputs.token || github.token }}
-          llm_api_key: ${{ secrets.OPENROUTER_API_KEY }}