Repository navigation
Fix/shared repo duplicate handling - #144
Merged
Merged
Conversation
LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)
LiveReview Pre-Commit Check: ran (iter:1, coverage:0%)
…more than once Same provider account connected in several orgs: only one org now answers a webhook event (the latest reviewer of that PR, else the oldest connection). GitHub App and token both connected in one org: when the App covers a repo the token connector is ignored for it. PR-opened webhooks and the background sync skip the token, and policy results are posted with the App's credentials. LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
GitHub sends a ping the moment a webhook is created. The token webhook path had no handler for it, so every new webhook logged an error and returned 400. It now returns 200 "ignored" before any conversion runs. LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
ConnectorForm spread `false` into the layout props whenever the page was not /git/github-app, which crashes React 19 development builds (every provider's form, e.g. /git/github/manual). Title and description are now passed explicitly and fall back to the layout defaults. LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
The card only checked whether reviews ran. When they ran but reported no issues there were no links to draw, and the Sankey piled its labels on top of each other. It now shows "No issues found in this period" in that case. LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
Card height comes from the grid layout, so an empty card was drawn at its full size with a screen of blank space. Empty cards are now displayed 7 rows tall. The EmptyState reports itself through a small context and DashboardGrid shrinks that card. It is display only: it is off in Customize mode and is never saved to the user's layout. LiveReview Pre-Commit Check: vouched (iter:1, coverage:0%)
The GitHub callback took the LiveReview identity from the GitHub user's email, so someone logged in as a@domain who installed from the app came back as a@gmail, in a new org, with the installation connected there. In-app installs now go through POST /api/v1/github-app/start (session-only, any org member), which puts the org and user into the signed state. The callback then only uses GitHub to prove which installations the user can access, re-checks that the user is still active in that org, connects there and returns to the page it started on. No Hexmos signup, no new user or org, no login hand-off, no verified GitHub email needed. "Find my GitHub accounts" connects (or offers) every installation the GitHub user can see. The public start link is sign-in only (/gh-login unchanged). Any member can Connect; Disconnect and Uninstall stay owner-only. Adds the connector.github_app.start audit action, UserStore.ActiveOrgAccess, UI buttons and docs, and scripts/purge_users.sh for clearing local test users. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- go-jose/v4 4.1.4 -> 4.1.6 (GHSA-mgcc-cww5-fp2q) and golang.org/x/net 0.61.0 -> 0.62.0 (GO-2026-6860, GO-2026-6866); govulncheck now reports nothing. - npm qs override 6.16.0 -> 6.16.1 (GHSA-6pq8-jhm2-2vcw). - certifi -> 2026.10.18+ in tests/mcp/requirements.txt and scripts/uv.lock; Pillow 13.0.0 in scripts/uv.lock (needs Streamlit 1.66.1, which allows Pillow 13) for the open Dependabot alerts. - Ignore GHSA-gcqx-w48m-w2h4 (deepmerge, no patched release, dev tooling only) in config/osv-scanner.toml until 2027-01-28. - scripts/purge_users.sh: stop changing IFS (semgrep ifs-tampering). Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Describe what changed and why.
Linked Issue
Link the agreed issue this PR fulfills.
Validation
Describe the most specific test or validation you ran.
Checklist
SECURITY.mdand updated related documentation if needed.Notes For Reviewers
Anything specific you want reviewers to focus on.
🔍 LiveReview
⚙️ Customize risk-based approval policy for this repository or your organization.