feat: save the default branch's analysis to a branch of its own, and generate the review's base in a step of its own

.github/actions/app-token/action.yml

@@ -0,0 +1,83 @@
+name: 'CodeBoarding App token'
+description: >-
+  Mints a CodeBoarding GitHub App token so comments and baseline commits appear as
+  codeboarding-review[bot] (the App avatar is the CodeBoarding logo) instead of
+  github-actions[bot]. Fails open: with App credentials absent or invalid, `token`
+  is empty and the caller falls back to github.token. End-user repositories cannot
+  reuse this, since the App private key is never shipped to their runners.
+inputs:
+  client_id:
+    description: 'vars.CODEBOARDING_APP_CLIENT_ID'
+    required: false
+    default: ''
+  app_id:
+    description: 'vars.CODEBOARDING_APP_ID'
+    required: false
+    default: ''
+  private_key:
+    description: 'secrets.CODEBOARDING_APP_PRIVATE_KEY'
+    required: false
+    default: ''
+outputs:
+  token:
+    description: 'The App installation token, or empty.'
+    value: ${{ steps.client.outputs.token || steps.app.outputs.token }}
+runs:
+  using: 'composite'
+  steps:
+    - name: Detect CodeBoarding GitHub App credentials
+      id: config
+      shell: bash
+      env:
+        CLIENT_ID: ${{ inputs.client_id }}
+        APP_ID: ${{ inputs.app_id }}
+        PRIVATE_KEY: ${{ inputs.private_key }}
+      run: |
+        client_id="${CLIENT_ID:-}"
+        app_id="${APP_ID:-}"
+
+        # GitHub App client IDs start with "Iv". If that value was stored in
+        # CODEBOARDING_APP_ID, use it as a client ID to avoid the deprecated
+        # app-id input path.
+        if [ -z "$client_id" ] && [ "${app_id#Iv}" != "$app_id" ]; then
+          client_id="$app_id"
+          app_id=""
+        fi
+
+        private_key_valid=false
+        if [ -n "$PRIVATE_KEY" ]; then
+          if printf '%s' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then
+            private_key_valid=true
+          else
+            echo "::warning::CODEBOARDING_APP_PRIVATE_KEY is not a valid PEM private key, so CodeBoarding will fall back to github-actions[bot]."
+            if printf '%b' "$PRIVATE_KEY" | openssl pkey -noout >/dev/null 2>&1; then
+              printf '%s\n' "::warning::CODEBOARDING_APP_PRIVATE_KEY looks like it contains literal \\n escapes. Store the downloaded PEM as multi-line secret text instead."
+            fi
+          fi
+        fi
+
+        {
+          [ -n "$client_id" ] && echo "has_client_id=true" || echo "has_client_id=false"
+          [ -n "$app_id" ] && echo "has_app_id=true" || echo "has_app_id=false"
+          echo "client_id=$client_id"
+          echo "private_key_valid=$private_key_valid"
+        } >> "$GITHUB_OUTPUT"
+    - uses: actions/create-github-app-token@v3
+      id: client
+      if: steps.config.outputs.has_client_id == 'true' && steps.config.outputs.private_key_valid == 'true'
+      continue-on-error: true
+      with:
+        client-id: ${{ steps.config.outputs.client_id }}
+        private-key: ${{ inputs.private_key }}
+    - uses: actions/create-github-app-token@v3
+      id: app
+      if: steps.config.outputs.has_client_id != 'true' && steps.config.outputs.has_app_id == 'true' && steps.config.outputs.private_key_valid == 'true'
+      continue-on-error: true
+      with:
+        app-id: ${{ inputs.app_id }}
+        private-key: ${{ inputs.private_key }}
+    - name: Warn when CodeBoarding App token is unavailable
+      if: steps.client.outputs.token == '' && steps.app.outputs.token == ''
+      shell: bash
+      run: |
+        echo "::warning::CodeBoarding GitHub App token is unavailable; falling back to github-actions[bot]. Check CODEBOARDING_APP_PRIVATE_KEY formatting if app credentials are configured."