Update CodeBoarding workflow configuration

.github/workflows/codeboarding-sync.yml

@@ -2,7 +2,10 @@ name: CodeBoarding sync
 
 on:
   push:
-    branches: [main]
+    branches: ['main']
+    # Loop guard: don't re-trigger on the files this workflow itself commits.
+    # List generated files only: user-authored scope configuration must still trigger
+    # regeneration, while a merged sync PR must not trigger a loop.
     paths-ignore:
       - '.codeboarding/*.md'
       - '.codeboarding/analysis.json'
@@ -15,16 +18,19 @@ on:
   workflow_dispatch:
     inputs:
       force_full:
-        description: Rebuild without the committed baseline
+        description: 'Ignore the committed baseline and rebuild it from scratch (full analysis).'
         type: boolean
+        required: false
         default: false
 
 permissions:
-  contents: write
-  pull-requests: write
-  id-token: write
+  contents: write   # commit the generated baseline + docs to the branch
+  pull-requests: write # open/update the rolling baseline PR for a protected target branch
+  id-token: write   # identifies this repo to CodeBoarding's hosted tier, used by the free
+                    # tier AND a license, and as the fallback until your own key exists
 
 concurrency:
+  # Serialize against itself so a push landing mid-run can't make two commits.
   group: codeboarding-sync
   cancel-in-progress: false
 
@@ -33,9 +39,12 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 60
     steps:
-      - uses: CodeBoarding/CodeBoarding-action@main
+      - uses: CodeBoarding/CodeBoarding-action@v1
         with:
           mode: sync
-          target_branch: main
+          force_full: ${{ inputs.force_full || false }}
           sync_strategy: pull_request
-          force_full: ${{ inputs.force_full || false }} 
+          target_branch: 'main'
+          # CodeBoarding's free hosted tier. No secret to add: the run authenticates
+          # with the GitHub OIDC token that `id-token: write` above grants.
+          llm: hosted