[sgtoj]

Summary

This is a full review of the app with every finding fixed. It also updates all Go modules and GitHub Actions, adopts github-app-setup-go v0.7.1, and brings CI, the Makefile, and releases in line with the other cruxstack Go repos. It contains breaking changes and will release as v1.0.0. docs/upgrading-to-v1.md lists every one.

The PR has three commits, and each builds and passes its tests on its own:

• ci: pinned actions, lint, govulncheck, a tidy check, amd64 and arm64 builds, and an image build. It also fixes dependabot, which never ran because its config was at .github/.dependabot.yaml, and a release rule that turned breaking changes into minor versions. Releases now build binaries before tagging.
• refactor!: the code, dependencies, and fixes below.
• docs: README, setup guides, the Lambda guide, and AGENTS.md.

Dependencies

• Go 1.24.4 to 1.27.3, go-github v79 to v93, okta-sdk-golang v6 to v8, slack-go v0.17.3 to v0.35.0, and every other module to its latest version.
• cockroachdb/errors is replaced by the standard library, which also removes sentry-go and its dependencies.
• govulncheck reported 11 reachable vulnerabilities before this change and none after.

github-app-setup-go

Both entry points now run on its runtime:

• The server loads its configuration at startup and reloads it on SIGHUP or when the installer saves credentials.
• Lambda loads on first use and retries a failed load on the next invocation. Before, one failed load (such as a brief SSM error) broke every invocation until AWS replaced the container.
• An optional installer at /setup creates the GitHub App from a manifest and saves its credentials to an env file or SSM. Once an app is registered, it refuses new codes.

Security

• Unsigned webhooks were accepted when no secret was set. They are now always rejected.
• The admin and scheduled endpoints were open when no admin token was set. They are now disabled without one, and the token is compared in constant time.
• The app manifest was public: true, so any account could install the app and send it signed events. It is now private, and events from other orgs are ignored.
• PR titles, logins, and Okta group names went into Slack unescaped. They are now escaped.
• Okta usernames are validated before they go into GitHub API paths.
• Auth headers are sent only to the GitHub API host.
• A data race in installation token refresh is fixed.

Fixes

• Manifest permissions: the manifest used permission names GitHub doesn't know and lacked Administration and Commit statuses read access, so PR checks silently skipped branch protection and statuses.
• PR compliance: a comment no longer cancels an approval, skipped and neutral checks pass as they do on GitHub, maintainers are recognized, and every page is read.
• Security alerts: reports read every page. Before, they read only the first 100 alerts of each kind.
• Okta sync, users:
  • Users with expired passwords are no longer removed.
  • Pending invitees aren't re-invited.
  • Child-team members aren't removed from the parent team.
  • Groups whose members can't be read are reported and not synced.
• Okta sync, teams:
  • create_team_if_missing is honored.
  • Teams whose slug differs from their name are found.
  • Two groups can't sync into one team.
• Okta sync, triggers:
  • Overlapping syncs are coalesced.
  • Webhooks trigger a sync only for teams a rule manages.
  • In server mode the sync runs after the webhook response.
• Orphaned users: members of a team whose sync failed are no longer reported as orphans.
• Configuration: invalid values used to fall back to defaults silently. Every problem is now reported at startup.
• Lambda: query strings, cookies, and base64 bodies now pass through from API Gateway, and ping and unhandled events no longer return 400.

Testing

• make check passes: golangci-lint reports 0 issues, the tests pass with the race detector, govulncheck is clean, and go mod tidy is clean.
• New unit tests cover the GitHub client against a fake API, including pagination, token caching under concurrency, compliance rules, and team sync. They also cover the Okta client, Slack escaping and message limits, config validation, the Lambda adapter, and the installer flow: save, reload, and a restart that reads the env file.
• e2e/ runs the 22 scenarios in fixtures/scenarios.json against the real service and mock GitHub, Okta, and Slack APIs, replacing cmd/verify.
• The server binary was smoke-tested, and the container image builds and runs as a non-root user.

Follow-ups

• terraform-aws-github-ops-app must be updated before the next release. It builds ./cmd/lambda with golang:1.24-alpine, which can't build a Go 1.27 module. It also sets APP_OKTA_KEY_ID, which the app never read; the correct name is APP_OKTA_PRIVATE_KEY_ID. Its 30-second default timeout is too short for a sync.
• Existing GitHub Apps need Administration (read) and Commit statuses (read), should be made private, and need the new permissions approved on the installation.
• Okta's githubUsername attribute should be read-only for users. Otherwise a user can point it at another GitHub account and give that account their team access.
• Lambda webhooks: Lambda can't run work after responding, so webhook-triggered syncs there still run before the response and may exceed GitHub's 10-second wait.

🤖 Generated with Claude Code