fix: harden and prepare GitHub App Cloud Run deployment

[kunaldhongade]

Closes #770

Changes

• Return generic webhook errors and retain diagnostics only in service logs.
• Paginate marker-comment lookup to prevent duplicate PR reports.
• Add a Cloud Run container, least-privilege App manifest, and Secret Manager deployment guide.
• Keep staging Cloud Run at one instance until a distributed idempotency store is reviewed.

Validation

• pnpm exec vitest run packages/github-app/test/github-app.test.ts
• pnpm --filter @submuxhq/codedecay-github-app build
• pnpm typecheck

[github-actions]

CodeDecay PR Check

Lead catch: Config area changed — Dockerfile:1

Dockerfile touches a config area and should be reviewed for regression impact.

Risk: Medium · Merge 41/100 · Decay 0/100 · Security 0/100

Full CodeDecay report

CodeDecay Report

Overall risk: Medium

Score	Value
Merge risk	41/100
Decay risk	0/100
Security risk	0/100

Findings	Count
High	3
Medium	2
Low	5

Changed Files

• Dockerfile added (+18/-0)
• docs/github-app-manifest.json added (+19/-0)
• docs/github-app.md modified (+31/-10)
• packages/github-app/src/github/comments.ts modified (+15/-7)
• packages/github-app/src/server.ts modified (+3/-1)
• packages/github-app/test/github-app.test.ts modified (+20/-0)

Likely Impacted Areas

• Medium Build and runtime configuration (config): Dockerfile
• Low Documentation (docs): docs/github-app-manifest.json, docs/github-app.md
• Low Source code (source): packages/github-app/src/github/comments.ts, packages/github-app/src/server.ts
• Low Tests (test): packages/github-app/test/github-app.test.ts

Normalized Impact Graph

Graph artifact: .codedecay/local/impact-graph.json (4968 node(s), 10028 edge(s))

• Confidence: Direct: 10028, inferred: 0, heuristic: 0
• codedecay-js-babel-symbols via @babel/parser (available, adapter 1.0.0)
  • Limitation: Call expressions are not connected to target symbols in this adapter version.
  • Limitation: Only JavaScript and TypeScript files parsed by @babel/parser are represented.
  • Limitation: Static import resolution does not resolve runtime dependency injection or dynamic imports.
• codedecay-python-lezer via @lezer/python (available, adapter 1.0.0)
  • Limitation: Dynamic imports, dependency injection, decorators without literal routes, and framework route registries are not resolved.
  • Limitation: Python impact evidence uses the @lezer/python grammar and conservative module-to-file resolution.
  • Limitation: Static test imports do not prove execution or assertion quality.
• Graph limitation: A static test import does not prove the symbol executed or that assertions cover its behavior.

Language And Parser Coverage

• Source files classified: 3
• Fully supported parser files: 3
• Limited files: 0
• Unsupported files: 0

Merge Risk Breakdown

• Score: 41/100
• Raw score before dampeners: 41/100
• Adjusted score before severity cap: 41/100
• Highest contributing severity: Medium

Top contributors:

• +16 Config area changed (direct): Dockerfile touches a config area and should be reviewed for regression impact.
• +4 Docs area changed (heuristic): docs/github-app-manifest.json touches a docs area and should be reviewed for regression impact.
• +4 Docs area changed (heuristic): docs/github-app.md touches a docs area and should be reviewed for regression impact.
• +4 Source area changed (heuristic): packages/github-app/src/github/comments.ts touches a source area and should be reviewed for regression impact.
• +4 Source area changed (heuristic): packages/github-app/src/server.ts touches a source area and should be reviewed for regression impact.

Notes:

• Untrusted memory context is visible but contributes 0 score until trusted evidence corroborates it.

Decay Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Risk Breakdown

• Score: 0/100
• Raw score before dampeners: 0/100
• Adjusted score before severity cap: 0/100

Security Matcher Coverage

• Changed source files scanned: 2
• Security candidates found: 0
• Skipped files: 0

Test Evidence

• Mode: heuristic-only
• Sources: none
• Changed source coverage:
• packages/github-app/src/github/comments.ts: not measured (no measurable changed lines)
• packages/github-app/src/server.ts: not measured (no measurable changed lines)
• Notes:
• No runtime coverage artifact was found. Test audit remains heuristic-only.

Changed Path Test Proof

Status	Count
Runtime-proven	0
Static-only	1
Weakened by mocks	0
Unproven	1

• Static-only packages/github-app/src/github/comments.ts (static-reference, deterministic)
  • Evidence: Referenced by packages/github-app/test/github-app.test.ts, but no runtime coverage artifact proves changed lines executed.
  • Static references: packages/github-app/test/github-app.test.ts
  • Repair task: Strengthen packages/github-app/test/github-app.test.ts so it executes packages/github-app/src/github/comments.ts with assertions; static import alone is not proof.
• Unproven packages/github-app/src/server.ts (missing-proof, heuristic)
  • Evidence: No runtime coverage or static test reference was found for this changed path.
  • Repair task: Add an integration test that reaches packages/github-app/src/server.ts without mocking the changed boundary.

Untrusted Memory Context

• Project invariant may be impacted (Dockerfile:1): Untrusted memory context: invariant "No hidden cloud or model call" applies to this change. The OSS CLI must remain useful without telemetry, API keys, hosted services, required LLM calls, or CodeDecayCloud.
• Project invariant may be impacted (Dockerfile:1): Untrusted memory context: invariant "Commands are explicit" applies to this change. CodeDecay must not run project commands unless they are configured and safety.allowCommands is true.
• Project invariant may be impacted (docs/github-app-manifest.json:1): Untrusted memory context: invariant "Tool evidence is separate from AI suggestions" applies to this change. Reports must not present agent/model suggestions as verified evidence unless backed by deterministic checks or command output.
• Project invariant may be impacted (docs/github-app-manifest.json:1): Untrusted memory context: invariant "Output must be actionable" applies to this change. Redteam reports and agent bundles should say what behavior to verify, which test proof is weak or missing, and what task a coding agent should perform.

Medium Risk Findings

• Config area changed (Dockerfile:1): Dockerfile touches a config area and should be reviewed for regression impact.

Low Risk Findings

• Docs area changed (docs/github-app-manifest.json:1): docs/github-app-manifest.json touches a docs area and should be reviewed for regression impact.
• Docs area changed (docs/github-app.md:24): docs/github-app.md touches a docs area and should be reviewed for regression impact.
• Source area changed (packages/github-app/src/github/comments.ts:36): packages/github-app/src/github/comments.ts touches a source area and should be reviewed for regression impact.
• Source area changed (packages/github-app/src/server.ts:27): packages/github-app/src/server.ts touches a source area and should be reviewed for regression impact.
• Test area changed (packages/github-app/test/github-app.test.ts:83): packages/github-app/test/github-app.test.ts touches a test area and should be reviewed for regression impact.

Recommended Checks

• Add an integration test that reaches packages/github-app/src/server.ts without mocking the changed boundary.
• Add or run tests covering packages/github-app/src/github/comments.ts
• Add or run tests covering packages/github-app/src/server.ts
• Flow check (Pull request redteam review): Check weak or missing test proof
• Flow check (Pull request redteam review): Keep deterministic evidence separate from AI suggestions
• Flow check (Pull request redteam review): Review edge cases and agent fix tasks
• Flow check (Pull request redteam review): Run codedecay redteam against the PR diff
• Run project command: Full validation (pnpm install && pnpm run lint && pnpm typecheck && pnpm test && pnpm build)
• Strengthen packages/github-app/test/github-app.test.ts so it executes packages/github-app/src/github/comments.ts with assertions; static import alone is not proof.
• Verify flow: Pull request redteam review
• Verify invariant: Commands are explicit
• Verify invariant: No hidden cloud or model call

Notes

CodeDecay is deterministic and local-first. This report was generated without telemetry, API keys, LLMs, or model calls.

---

Found by CodeDecay - deterministic, local-first, no telemetry.