fix: align PR reviews with the main analysis configuration

[ivanmilevtues]

Root cause

Reviews #5 and #6 are based on current main, but their workflows generate a different architecture for that same commit:

Workflow	Action ref	Engine in the reported runs	Depth cap
Main sync	@v1	0.14.4	2
PR review	@refs/pull/120/head	0.14.1	3

The PR-head pin was left over from testing Action PR dotnet#120. The Action correctly isolates cached state by engine/configuration. Review #5 therefore missed the sync artifact, rejected the committed depth-2 baseline as incompatible, and generated a new depth-3 baseline. Review #6 reused that alternate baseline. Rebasing does not change either workflow setting.

This is an eShop workflow configuration bug, not a webview rendering or merge-base selection bug. The production webview API returns exactly the base/head JSON in the Action artifacts.

Reproduction established before the fix

1. Open main in Explore. It has 10 top-level components, including Basket API and Catalog Service.
2. Open PR #6 in Review. Its reported run has 8 top-level components, including Ordering, Webhooks, and Loose files in src.WebApp. The GitHub comment shows the same alternate graph.
3. Confirm that this is not a stale branch: gh api repos/CodeBoarding/eShop/compare/main...c068b520e50a4cca2ab0369f1bc77a63cc64bb3e reports behind_by: 0, and its merge base is the current main baseline commit. Review metadata records that same commit.
4. Inspect PR #5's run: it misses codeboarding-base-8595c58016359d69-<merge-base>, runs full baseline analysis at depth 3, and publishes base artifact 10783925749. PR feat: validate basket products against Catalog — architecture impact demo #6's metadata points to that exact ID.
5. Compare that artifact with the sync run's artifact 10782827140, named codeboarding-base-fad27b0797f73921-<merge-base>. Both describe the same source-tree hash, but their graphs differ. The sync artifact's analysis.json is byte-for-byte identical to committed main; the review baseline is not.

To reproduce from scratch, sync a repository with engine 0.14.4/depth 2, branch from that synced commit, and review it with the old PR-120 ref/depth 3. The first review generates an alternate base; subsequent reviews reuse it, even after rebasing onto main.

Fix

Use @v1, llm: hosted, and explicit depth_cap: 2 in both workflows. Keep the existing merge-base comparison behavior and main analysis unchanged.

Verification

• Replayed the actual Action state-name and baseline-selection scripts with the downloaded eShop artifacts, stubbing only the engine invocation. Old settings select the alternate graph; corrected settings select the exact committed-main bytes and invoke analysis only for the head.
• Parsed both workflow YAML files and asserted matching Action ref, provider, and depth; also checked that depth equals committed main's cap.
• All 45 existing Action state/merge-base tests passed. The tested orchestration scripts are identical to the currently published @v1 scripts.
• git diff --check passed.
• Live verification passed: this PR's review run uses engine 0.14.4/depth 2 and references the original sync base artifact ID 10782827140. The production API's baseData equals committed main's entire parsed JSON. No full baseline regeneration occurred.
• Browser verification: this PR in Review renders all 10 main component names, including separate Basket API and Catalog Service. The old PR feat: validate basket products against Catalog — architecture impact demo #6 still reproduces the 8-component graph.
• All four PR checks passed: CodeBoarding review, eShop application tests, Playwright tests, and Markdown lint.

Existing reviews

This PR does not merge itself or rewrite saved artifacts. After merging, update PRs #5/#6 to include the corrected workflow and let new review runs complete. Re-running an old workflow run uses its old workflow revision and is not a repair. Previously saved run-specific URLs will continue to show their historical analyses; the unpinned PR URLs select the latest run.

[github-actions]

CodeBoarding review

Status: 0 changed components

See the full change in CodeBoarding.

graph LR
    n_Client_App["Client App"]
    n_Ordering_Service["Ordering Service"]
    n_Identity_API["Identity API"]
    n_Web_Frontends["Web Frontends"]
    n_Catalog_Service["Catalog Service"]
    n_Webhooks_and_Shared_Infrastructure["Webhooks and Shared Infrastructure"]
    n_Event_Bus["Event Bus"]
    n_Basket_API["Basket API"]
    n_Application_Host_and_Defaults["Application Host and Defaults"]
    n_Payment_Processor["Payment Processor"]
    n_Payment_Processor -- "publishes events to" --> n_Event_Bus
    n_Ordering_Service -- "stores outbox events in" --> n_Catalog_Service
    n_Ordering_Service -- "uses migration helpers in" --> n_Webhooks_and_Shared_Infrastructure
    n_Ordering_Service -- "publishes and subscribes events via" --> n_Event_Bus
    n_Ordering_Service -- "configures defaults from" --> n_Application_Host_and_Defaults
    n_Web_Frontends -- "subscribes to events on" --> n_Event_Bus
    n_Web_Frontends -- "configures HTTP and config defaults from" --> n_Application_Host_and_Defaults
    n_Catalog_Service -- "uses migration helpers in" --> n_Webhooks_and_Shared_Infrastructure
    n_Catalog_Service -- "publishes and subscribes events via" --> n_Event_Bus
    n_Webhooks_and_Shared_Infrastructure -- "subscribes to events on" --> n_Event_Bus
    n_Webhooks_and_Shared_Infrastructure -- "configures authentication defaults from" --> n_Application_Host_and_Defaults
    n_Event_Bus -- "dispatches events to" --> n_Payment_Processor
    n_Event_Bus -- "dispatches events to" --> n_Ordering_Service
    n_Event_Bus -- "dispatches events to" --> n_Web_Frontends
    n_Event_Bus -- "dispatches events to" --> n_Catalog_Service
    n_Event_Bus -- "dispatches events to" --> n_Webhooks_and_Shared_Infrastructure
    n_Event_Bus -- "dispatches events to" --> n_Basket_API
    n_Basket_API -- "subscribes to events on" --> n_Event_Bus
    n_Basket_API -- "configures defaults from" --> n_Application_Host_and_Defaults
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;

Loading

_{download artifacts · run 36084071642}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-25T01:57:12.922277Z	bd57155	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.