Add expression quote-escaping test & implement server job timeouts an…

[Bnjoroge1]

…d runner lease reaper

---

Summary by cubic

Adds a GitHub App webhook that triggers workflows on push/PR and reports per‑job status to GitHub Checks. Adds server‑side job timeouts and a lease reaper to auto‑cancel/fail stuck jobs, plus a one‑click App registration flow, tests, and docs.

• New Features

  • Webhook receiver at /api/v1/github/webhooks with HMAC signature verification (requires AKSH_WEBHOOK_SECRET); loads workflows from AKSH_LOCAL_WORKSPACE or GitHub and triggers matching runs.
  • GitHub Checks: create/update per‑job check runs (queued → in_progress → completed); mock mode if AKSH_GITHUB_TOKEN is unset.
  • Background reaper: enforce job timeout (default 360m) and expire runner leases after 120s; enqueue cancellations or mark failed, and clean up sessions.
  • One‑click GitHub App Manifest flow at /api/v1/github/register and /api/v1/github/callback; docs at docs/github-app-webhook.md; tests for webhook flows, manifest conversion, reaper behavior, and escaped single quotes in expressions.

• Bug Fixes

  • Paginate PR changed files retrieval to handle large pull requests.
  • Do not initialize last_renewed_at in the legacy non‑renewing next_message path to avoid false lease renewals.

^{Written for commit 745884b. Summary will update on new commits.}

[cubic-dev-ai]

4 issues found across 7 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

1 issue found across 3 files (changes from recent commits).

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="crates/aksh-runner-server/src/github.rs">

<violation number="1" location="crates/aksh-runner-server/src/github.rs:467">
P1: Reject empty webhook secrets, not just missing ones. An empty `AKSH_WEBHOOK_SECRET` is treated as configured and allows signatures generated with a public empty key.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

P1: Reject empty webhook secrets, not just missing ones. An empty AKSH_WEBHOOK_SECRET is treated as configured and allows signatures generated with a public empty key.

Prompt for AI agents

Check if this issue is valid — if so, understand the root cause and fix it. At crates/aksh-runner-server/src/github.rs, line 467:

<comment>Reject empty webhook secrets, not just missing ones. An empty `AKSH_WEBHOOK_SECRET` is treated as configured and allows signatures generated with a public empty key.</comment>

<file context>
@@ -452,15 +464,18 @@ pub(crate) async fn handle_github_webhook(
-        if !verify_signature(secret, &body, sig_header) {
-            return Err(StatusCode::UNAUTHORIZED);
-        }
+    let secret = shared.state.webhook_secret.as_ref().ok_or_else(|| {
+        warn!("Webhook secret not configured on server, rejecting request");
+        StatusCode::UNAUTHORIZED
</file context>

Suggested change

	let secret = shared.state.webhook_secret.as_ref().ok_or_else(|| {
	warn!("Webhook secret not configured on server, rejecting request");
	StatusCode::UNAUTHORIZED
	})?;
	let secret = shared
	.state
	.webhook_secret
	.as_deref()
	.filter(|secret| !secret.is_empty())
	.ok_or_else(|| {
	warn!("Webhook secret not configured on server, rejecting request");
	StatusCode::UNAUTHORIZED
	})?;