feat: decide the credential from the inputs that are set, and refuse a model on hosting

[Svilen-Stefanov]

Stacked on #134. Two rules from the licensing spec (PR #39) that the Action can apply without anything from licensing-aws.

llm is optional (spec D-16)

Without llm, the inputs that are set decide:

Workflow	Result
no with: block	CodeBoarding hosting
anthropic_api_key only	Anthropic, directly
aws_bedrock_api_key + aws_bedrock_region	Bedrock (one provider, several inputs)
aws_bedrock_region only	refused: missing_provider_key (it names Bedrock but configures nothing)
anthropic_api_key + openai_api_key	refused: new code several_provider_keys, naming both inputs
llm: <provider>	unchanged: that provider or a refusal

The webview's setup dialog should write one of two shapes, never every provider's key:

- uses: CodeBoarding/CodeBoarding-action@v1          # hosting

- uses: CodeBoarding/CodeBoarding-action@v1          # own key
  with:
    anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}

The trade-off. GitHub reads a secret that does not exist as an empty string, so an unnamed workflow whose only key is missing runs on hosting. What reports it:

• the log's first line, for example "CodeBoarding is running on …, because no provider key is set";
• a new "Chosen" row in the job summary;
• a hosting run without id-token: write, which is refused with "If you meant to use your own provider key, check that its secret exists."

A named provider still never falls back, so the protected test test_a_named_provider_never_falls_back_to_codeboarding_credentials is untouched and passes. AGENTS.md records the decision next to it.

Hosting refuses a named model (spec D-13)

A hosting run that sets model, agent_model or parsing_model is refused before the checkout, with a new code, hosted_with_model. So is one with an AGENT_MODEL or PARSING_MODEL in the job's environment, because the engine reads those.

• No llm set: the refusal says to check the key's secret. A model on a hosting run usually means the workflow meant to use its own key and the secret is missing.
• llm: hosted: the refusal says to remove the line, or to name the provider.
• Own-key runs keep their model inputs.

The proxy-side model allowlist is still needed (review finding B2). This is only the Action's half.

Not in this PR (needs licensing-aws or the release)

• /run/start and /run/finish in v2 form (fail loud, outcome names, run id in the relay)
• id-token: write for own-key runs
• the refusal and unavailable comments
• GitHub Enterprise Server

Proposal: Action v2 Changes.

Testing

python -m unittest discover -s tests: everything passes except test_action_state…test_sync_without_baseline_uses_configured_depth_directly. That test fails identically on #134, because macOS bash 3.2 cannot run ${FORCE_FULL,,}; CI runs bash 5.

• New tests cover every deduction row above, the "Chosen" row, the id-token hint, and the model refusal (inputs, inherited variables, both messages, and the inputs reaching the check).
• black==25.9.0 and shellcheck are clean.

🤖 Generated with Claude Code

[codeboarding-review]

CodeBoarding review

Status: 1 changed component

See the full change in CodeBoarding.

graph LR
    n_action_scripts["action_scripts"]
    classDef added fill:#1f883d,stroke:#0b5d23,color:#ffffff;
    classDef modified fill:#bf8700,stroke:#7d4e00,color:#ffffff;
    classDef deleted fill:#cf222e,stroke:#82071e,color:#ffffff,stroke-dasharray:5 3;
    class n_action_scripts modified;

Loading

_{download artifacts · run 37545861964}