fix(security): close permission and integration gaps

[tinsever]

Description

Fix the remaining permission, credential, comment parsing, and workflow issues identified in the security review.

• Require a fresh GitLab token when the server URL changes, so saved credentials cannot be sent to another host.
• Check task update permission before duplicating parent links. Users with create-only permission can still duplicate tasks without parent links.
• Keep ordinary GitLab label changes from changing task status or priority, including through comma-separated label names.
• Prevent crafted backtick sequences from freezing comment rendering and apply the existing 10,000-character limit to both comment APIs.
• Keep users on the Gitea settings screen when their Gitea token is invalid. HTTP 401 remains reserved for missing Kaneo authentication.
• Stop Dependabot automation from merging previously closed PRs, even after a later bot update.
• Pin Blacksmith actions to commit SHAs and remove their exception from the workflow security scanner.

Related Issue(s)

Follows #1801, which fixed integration permissions when moving projects between workspaces.

Type of Change

• Bug fix
• Performance improvement
• Test addition or update

How Has This Been Tested?

• Unit tests: pnpm test, 1,345 tests passed across the repository.
• Integration tests: 31 tests passed against a disposable PostgreSQL database, covering task duplication, GitLab sync boundaries, Gitea credential errors, and comment limits.
• Other: all 63 security script tests passed with node --test scripts/security/*.test.mjs.
• Other: repository typechecks, targeted Biome checks, workflow YAML parsing, and pnpm openapi:check passed.

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my own code
• I understand and take responsibility for every change, and I wrote this pull request description in my own words
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• Any dependent changes have been merged and published

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-26T09:04:51.496312Z	73f0a14	Manual request

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[qodo-free-for-open-source-projects]

PR Summary by Qodo

Close permission, integration, comment, and workflow security gaps

🐞 Bug fix 🧪 Tests ⚙️ Configuration changes 🕐 40+ Minutes

AI Description

• Prevent cross-host credential reuse and enforce permissions across task and GitLab
 synchronization.
• Bound and linearize comment processing while preserving authenticated integration error handling.
• Harden Dependabot and third-party workflow actions with regression coverage.

Diagram

graph TD
  Client["API Client"] --> Routes["API Routes"] --> Guards["Security Guards"] --> Domain["Tasks and Comments"]
  Guards --> Integrations["Git Integrations"]
  Workflows["GitHub Workflows"] --> Automation["Trusted Automation"] --> Actions["Pinned Actions"]

Loading

High-Level Assessment

The targeted defense-in-depth approach is appropriate: each finding is fixed at its authorization, validation, parsing, or automation boundary and backed by focused regression coverage. A broad integration or permission-layer rewrite would increase risk without materially improving these independent fixes.

Files changed (35) +477 / -127

Bug fix (2) +2 / -2

list-gitea-repositories.tsClassify invalid Gitea tokens as request errors +1/-1

Classify invalid Gitea tokens as request errors

• Returns HTTP 400 instead of 401 when repository listing fails token verification, preserving 401 for Kaneo authentication failures.

apps/api/src/gitea-integration/controllers/list-gitea-repositories.ts

verify-gitea-access.tsSeparate Gitea rejection from session authentication +1/-1

Separate Gitea rejection from session authentication

• Maps upstream Gitea 401 responses to HTTP 400 so clients remain on integration settings rather than entering Kaneo login handling.

apps/api/src/gitea-integration/controllers/verify-gitea-access.ts

Tests (1) +19 / -0

normalize-comment-markdown.test.tsCover adversarial backtick normalization +19/-0

Cover adversarial backtick normalization

• Adds correctness coverage for unequal and nested runs plus a timing regression test with thousands of unmatched delimiter lengths.

apps/web/src/lib/normalize-comment-markdown.test.ts

Other (32) +456 / -125

auto-merge.ymlPrevent rejected Dependabot PRs from re-entering automation +7/-3

Prevent rejected Dependabot PRs from re-entering automation

• Limits triggers to bot-driven open and synchronize events, verifies the actor is Dependabot, and rejects any PR with a prior closed event before merging.

.github/workflows/auto-merge.yml

build-images.ymlPin Blacksmith image-build actions +4/-4

Pin Blacksmith image-build actions

• Replaces mutable Blacksmith checkout, builder, and build action tags with immutable commit SHAs.

.github/workflows/build-images.yml

ci.ymlPin Blacksmith actions throughout CI +17/-17

Pin Blacksmith actions throughout CI

• Pins all Blacksmith checkout, Docker builder, and image build invocations in CI to immutable commits.

.github/workflows/ci.yml

code-review.ymlPin code-review checkout actions +2/-2

Pin code-review checkout actions

• Pins trusted workflow checkout steps used by code-review authorization and execution jobs.

.github/workflows/code-review.yml

deploy-site.ymlPin site deployment checkout +1/-1

Pin site deployment checkout

• Uses an immutable Blacksmith checkout commit for site deployments.

.github/workflows/deploy-site.yml

helm-chart.ymlPin Helm publishing checkouts +2/-2

Pin Helm publishing checkouts

• Pins both repository and verified release-tag checkout steps to the approved Blacksmith commit.

.github/workflows/helm-chart.yml

helm-validate.ymlPin Helm validation checkout +1/-1

Pin Helm validation checkout

• Uses an immutable Blacksmith checkout commit during chart validation.

.github/workflows/helm-validate.yml

nightly.ymlPin nightly security scan checkouts +2/-2

Pin nightly security scan checkouts

• Pins Blacksmith checkout usage in nightly secret-scanning and workflow-security jobs.

.github/workflows/nightly.yml

pr-size-labeler.ymlPin trusted size-labeler checkout +1/-1

Pin trusted size-labeler checkout

• Pins the checkout used to read base-branch pull-request size configuration.

.github/workflows/pr-size-labeler.yml

pr-title.ymlPin pull-request title policy checkout +1/-1

Pin pull-request title policy checkout

• Pins the base-branch checkout used to validate pull-request titles.

.github/workflows/pr-title.yml

publish-mcp.ymlPin MCP publishing checkouts +2/-2

Pin MCP publishing checkouts

• Pins Blacksmith checkout steps used by MCP package publishing jobs.

.github/workflows/publish-mcp.yml

publish-planka-import.ymlPin Planka importer publishing checkout +1/-1

Pin Planka importer publishing checkout

• Pins the repository checkout used to publish the Planka import package.

.github/workflows/publish-planka-import.yml

release.ymlPin release workflow checkouts +3/-3

Pin release workflow checkouts

• Pins repository checkout steps across release preparation, validation, and publishing jobs.

.github/workflows/release.yml

ui-review-run.ymlPin UI review execution checkouts +3/-3

Pin UI review execution checkouts

• Pins Blacksmith checkout usage in UI review planning, capture, and supporting jobs.

.github/workflows/ui-review-run.yml

ui-review.ymlPin UI review authorization checkout +1/-1

Pin UI review authorization checkout

• Pins the trusted workflow checkout used to authorize UI review requests.

.github/workflows/ui-review.yml

update-contributors.ymlPin contributor workflow checkout +1/-1

Pin contributor workflow checkout

• Uses an immutable checkout action commit before generating contributor assets.

.github/workflows/update-contributors.yml

schema.tsEnforce comment write limits +4/-2

Enforce comment write limits

• Applies the existing 10,000-character maximum to both comment creation and update payloads.

apps/api/src/comment/schema.ts

index.tsDocument corrected Gitea error semantics +7/-3

Document corrected Gitea error semantics

• Updates route response descriptions to distinguish invalid upstream credentials from missing Kaneo authentication.

apps/api/src/gitea-integration/index.ts

create-gitlab-integration.tsBind stored GitLab tokens to their destination +16/-1

Bind stored GitLab tokens to their destination

• Allows token reuse only when the normalized GitLab base URL is unchanged. A new host, port, or path requires a freshly supplied token before any remote request occurs.

apps/api/src/gitlab-integration/controllers/create-gitlab-integration.ts

schema.tsClarify GitLab token reuse requirements +2/-1

Clarify GitLab token reuse requirements

• Documents that omitting a token is valid only when retaining the existing normalized GitLab base URL.

apps/api/src/gitlab-integration/schema.ts

sync-label-to-gitlab.tsBlock task-field labels from ordinary GitLab label sync +12/-0

Block task-field labels from ordinary GitLab label sync

• Detects status and priority labels, including entries inside comma-separated names, and excludes them from add and remove synchronization paths.

apps/api/src/plugins/gitlab/utils/sync-label-to-gitlab.ts

duplicate-task.tsRequire update permission when duplicating parent links +8/-0

Require update permission when duplicating parent links

• Rejects duplication of tasks carrying parent relations unless the caller has task:update permission, before creating records or copying assets. Standalone tasks remain duplicable with create permission.

apps/api/src/task/controllers/duplicate-task.ts

index.tsPass update authorization into task duplication +9/-3

Pass update authorization into task duplication

• Checks task:update permission for duplication requests and documents the conditional parent-link requirement in route metadata and error responses.

apps/api/src/task/index.ts

openapi.jsonRegenerate API contracts for security behavior +10/-8

Regenerate API contracts for security behavior

• Reflects comment length limits, conditional task duplication permissions, corrected Gitea error semantics, and GitLab token destination requirements.

apps/docs/openapi.json

normalize-comment-markdown.tsMake backtick delimiter matching linear +24/-54

Make backtick delimiter matching linear

• Indexes matching backtick runs in one reverse pass instead of repeatedly scanning suffixes, preventing crafted comments from causing quadratic rendering work.

apps/web/src/lib/normalize-comment-markdown.ts

workflows.test.mjsTest workflow automation and immutable action pins +46/-2

Test workflow automation and immutable action pins

• Adds coverage rejecting previously closed Dependabot PRs and human-triggered reopen paths. It also scans every workflow for immutable Blacksmith commits and confirms the scanner exemption is gone.

scripts/security/workflows.test.mjs

comment-bounds.test.tsTest comment limits across both APIs +57/-0

Test comment limits across both APIs

• Verifies create and update limits on comment and activity endpoints, including acceptance and unchanged storage at exactly 10,000 characters.

tests/api-integration/comment-bounds.test.ts

gitea-credential-errors.test.tsTest Gitea credential error separation +63/-0

Test Gitea credential error separation

• Confirms invalid upstream tokens return 400 without leaking secrets, while anonymous Kaneo requests still return 401 before contacting Gitea.

tests/api-integration/gitea-credential-errors.test.ts

task-duplicate.test.tsTest parent-link duplication permissions +63/-1

Test parent-link duplication permissions

• Covers custom-role and API-key callers with create-only permissions, verifying linked tasks are rejected without side effects while standalone tasks still duplicate.

tests/api-integration/task-duplicate.test.ts

create-gitlab-integration.test.tsTest GitLab token destination binding +61/-1

Test GitLab token destination binding

• Verifies saved tokens are never sent to changed hosts, ports, or paths, while normalized equivalent URLs and fresh replacement tokens remain supported.

tests/api/gitlab-integration/create-gitlab-integration.test.ts

sync-label-to-gitlab.test.tsTest protected GitLab label filtering +24/-0

Test protected GitLab label filtering

• Covers direct and comma-separated status or priority labels for both add and remove paths while preserving ordinary label removal.

tests/api/plugins/gitlab/utils/sync-label-to-gitlab.test.ts

zizmor.ymlRequire immutable pins for Blacksmith actions +1/-4

Require immutable pins for Blacksmith actions

• Removes the Blacksmith tag-pin exception so the workflow scanner requires commit hashes for every action provider.

zizmor.yml

[qodo-free-for-open-source-projects]

Code Review by Qodo

🐞 Bugs (1) 📘 Rule violations (0) 📎 Requirement gaps (0) 🎨 UX issues (0) 🔗 Cross-repo conflicts (0) 📜 Skill insights (0)

1. A scanner comment repeats its setting ✓ Resolved 📘 Rule violation ⚙ Maintainability

Description

The comment above "*": hash-pin merely translates that setting into prose instead of documenting a
non-obvious constraint or rationale. A later change to the pinning policy could leave this redundant
description stale and mislead maintainers about the effective scanner configuration.

Code

zizmor.yml[6]

+        # All actions, including build and checkout providers, use immutable commits.

Evidence

Compliance rule 18 permits comments for constraints or surprising decisions, while the cited comment
only narrates the immediately following wildcard policy.

AGENTS.md: Write Comments Only for Constraints and Surprising Decisions: AGENTS.md: Write Comments Only for Constraints and Surprising Decisions: AGENTS.md: Write Comments Only for Constraints and Surprising Decisions: AGENTS.md: Write Comments Only for Constraints and Surprising Decisions
zizmor.yml[6-7]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The comment above the wildcard `hash-pin` policy only restates the configuration and can become stale without adding rationale.
## Fix Focus Areas
- zizmor.yml[6-7]
## Recommended Fix
Remove the added comment and leave the self-explanatory wildcard `hash-pin` policy in place.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

2. Eligible Dependabot updates never merge 🐞 Bug ≡ Correctness

Description

The new gh api call queries the pull request's Issues events endpoint, but the dependabot job
grants no issues: read permission. When an otherwise eligible update reaches this step, the API
request is denied and set -euo pipefail prevents the required-check and merge commands from
running.

Code

.github/workflows/auto-merge.yml[R50-52]

+          # A later bot update must not re-enable automation on a rejected PR.
+          gh api --paginate "repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events" \
+            | jq -se 'add | all(.[]; .event != "closed")'

Evidence

The changed command calls repos/$GITHUB_REPOSITORY/issues/$PR_NUMBER/events, while the job
explicitly grants only contents, pull-requests, checks, and statuses permissions. Since the shell
enables set -euo pipefail, failure of that unauthorized API request terminates the step before the
subsequent gh pr checks and gh pr merge commands.

.github/workflows/auto-merge.yml[21-28]
.github/workflows/auto-merge.yml[47-67]

Agent prompt

The issue below was found during a code review. Follow the provided context and guidance below and implement a solution

## Issue description
The Dependabot merge step now reads pull-request issue events, but its job token lacks permission for the Issues endpoint. The failing API call stops the shell script before it can evaluate checks or enable auto-merge.
## Fix Focus Areas
- .github/workflows/auto-merge.yml[21-28]
- .github/workflows/auto-merge.yml[50-52]
## Recommended Fix
Add `issues: read` to the `dependabot` job's explicit `permissions` block. Keep the existing event-history check unchanged so it can reject previously closed pull requests while allowing eligible new Dependabot updates to continue to the merge commands.

ⓘ Copy this prompt and use it to remediate the issue with your preferred AI generation tools

---

Tip of the day

💡 Did you know, you can type 'qodo, fix this' on a finding and the fix lands right on your PR

More tips ↗ | Customize Qodo ↗ | Qodo docs ↗

[tinsever]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. You're on a roll.

Reviewed commit: 73f0a14033

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".