fix(review): stop attempting a cache save a comment run cannot make

[Svilen-Stefanov]

Every /codeboarding run currently ends with two warnings that look like a failure:

##[warning]Cache reservation failed: cache write denied: token has no writable scopes
Failed to save: Unable to reserve cache with key cb-head-v1-..., another job may be creating this cache.
##[warning]Cache save failed.

Nothing is broken. GitHub gives a run triggered by issue_comment a read-only cache token, so the save can never succeed. The cache action's "another job may be creating this cache" wording hides the real reason, which is only in the line above it.

Confirmed by experiment, not inference

Same repository, same job definition, same permissions (contents: read, pull-requests: write, issues: write, id-token: write), same action release — only the trigger differs:

Trigger	Restore	Save
pull_request	works	Cache saved with key: cb-head-v1-…
issue_comment	works — Cache restored from key: cb-base-v1-…d8853c4	denied — token has no writable scopes
push (sync)	n/a	saves both base keys

Note the middle row: a comment run reads the entry sync wrote 20 minutes earlier. Sharing works; only the write side is closed. No workflow permission changes this — contents: write might, but the review job analyzes untrusted fork code on /codeboarding, so trading repo-write access for a cache optimisation is the wrong side of that bargain.

What changes

The two review save steps are skipped for issue_comment. A comment run behaves exactly as before minus the misleading warnings.

The docs stop claiming /codeboarding publishes a shared entry, and state the two consequences that follow instead:

• a repository reviewed only through /codeboarding never builds a chain, so every command re-derives the head from the base;
• /codeboarding refresh cannot persist what it recomputes — it fixes the comment it posts, while the next run still restores the analysis it was asked to replace.

A pushed commit is what builds the chain, which is why the companion PR adds synchronize to the recommended workflow.

Verification

83 tests pass. The new test_reviews_do_not_attempt_a_save_a_comment_run_cannot_make parses action.yml and fails if either review save step loses the guard — mutation-checked by removing it.

🤖 Generated with Claude Code

[codeboarding-review]

CodeBoarding review

Status: 0 changed components

See the full change in CodeBoarding.

graph LR
    n_Visual_Rendering_Engine["Visual Rendering Engine"]
    n_Structural_Diff_Engine["Structural Diff Engine"]
    n_Interaction_Orchestrator["Interaction Orchestrator"]
    n_Visual_Rendering_Engine -- "Returns rendering metadata and diagram artifacts" --> n_Interaction_Orchestrator
    n_Structural_Diff_Engine -- "Provides annotated diff model for visualization" --> n_Visual_Rendering_Engine
    n_Interaction_Orchestrator -- "Triggers structural comparison via CLI" --> n_Structural_Diff_Engine
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;

Loading

_{download artifacts · run 32194495188}