feat(integrations): PR changed-file discovery, org allowlists, app installation validation, and container hardening

[ayomideadeniran]

Summary

This pull request delivers repository integration features and container security hardening for GasGuard across four key areas:

1. Pull Request Changed-File Discovery (Fixes Implement pull request changed-file discovery #1043):

   • Added PullRequestFileDiscovery to fetch and normalize changed files in GitHub pull requests with full pagination support (per_page=100).
   • Supports file-type filtering, exclusion patterns, and extraction of smart contract files (.sol, .rs, .vy, .cairo, .fe).
   • Calculates change metrics (additions, deletions, file status breakdown) and automatically flags security-sensitive file changes (e.g., .github/workflows/, dependency lockfiles, environment configs).

2. GitHub Organization Allowlists (Fixes Support GitHub organization allowlists #1042):

   • Added OrganizationAllowlist to enforce organization-level repository access control.
   • Supports exact matching, case-insensitive comparison, wildcard glob patterns (MDTechLabs-*, *), and dynamic allowlist management.
   • Provides optional verified author membership checks against GitHub API with in-memory TTL caching to prevent rate-limiting.

3. GitHub App Repository Installation Validation (Fixes Add GitHub repository installation validation #1041):

   • Added InstallationValidator to inspect and validate GitHub App installations for target repositories.
   • Detects suspended installations (with suspended_at and suspended_by attribution).
   • Validates repository permissions against requirements with hierarchical rank evaluation (admin > write > read) and diagnostic error reporting.

4. Container and Image Hardening (Fixes Add container and image hardening #1007):

   • Updated apps/api/dockerfile to use minimal pinned base image node:20.18.0-alpine3.20 with multi-stage build, non-root user gasguard (UID 10001), tini PID 1 init system, cache cleanup, and healthcheck.
   • Updated apps/api-service/Dockerfile.e2e to a multi-stage non-root hardened runner.
   • Added security options (security_opt: ["no-new-privileges:true"]) and non-root execution (user: "10001:10001") across services in docker-compose.yml.
   • Added automated container vulnerability scanning workflow (.github/workflows/container-security-scan.yml) uploading SARIF reports.
   • Documented operational container security standards in docs/CONTAINER_HARDENING.md.

Related Issues

• Closes Implement pull request changed-file discovery #1043
• Closes Support GitHub organization allowlists #1042
• Closes Add GitHub repository installation validation #1041
• Closes Add container and image hardening #1007

Verification

• Unit test suite: ./node_modules/.bin/jest src/integrations/github --runInBand (7 suites, 70 tests passed).
• TypeScript compilation: ./node_modules/.bin/tsc --target ES2020 --module commonjs --skipLibCheck --noEmit src/integrations/github/index.ts passed with zero errors.
• Verified Dockerfile syntax and container scan workflow configuration.

[drips-wave]

@ayomideadeniran Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits