feat(task-manager): GitHub integration

[neSpecc]

This PR adds the initial GitHub App integration and basic support for a Task Manager based on GitHub Issues.

Key changes include:

• GitHub App infrastructure: routes, services, and a Redis-backed installation state store for secure installs and webhooks.
• Project-level Task Manager support (GitHub Issues), including new model fields and GraphQL types to link events with GitHub issues.
• New GraphQL mutations to configure or disconnect the task manager for a project.
• Safer updateProject logic with support for partial updates and field removal.
• Updated dependencies required for GitHub integration.

This lays the foundation for future Task Manager features and deeper GitHub integration.

[Copilot]

Pull request overview

This PR introduces GitHub App integration for a Task Manager feature based on GitHub Issues. The implementation includes OAuth flows, webhook handling, GraphQL API extensions, and Redis-backed state management.

Changes:

• Added GitHub App integration infrastructure with secure OAuth flows, webhook handling (including HMAC signature verification), and Redis-backed installation state store
• Extended GraphQL schema with Task Manager types, mutations, and event fields to support GitHub Issue linking
• Updated project model to support partial updates and added taskManager configuration field
• Upgraded test dependencies (Jest 26→30, ts-jest, @types/jest) and updated test files to remove deprecated done callbacks

Reviewed changes

Copilot reviewed 26 out of 29 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
src/integrations/github/service.ts	Core GitHub API service with JWT/OAuth authentication, issue creation, and Copilot assignment
src/integrations/github/routes.ts	Express routes for OAuth flows, webhooks, and repository management
src/integrations/github/store/install-state.redis.store.ts	Redis-backed store for OAuth state with atomic operations
src/resolvers/project.js	New mutations for connecting/disconnecting Task Manager and updating settings
src/models/project.ts	Updated updateProject to support partial updates
src/typeDefs/*.ts	GraphQL type definitions for Task Manager, settings, and event integration
package.json	Dependency updates including Octokit libraries, Jest 30, argon2, and jsonwebtoken
test/resolvers/project.test.ts	Comprehensive tests for Task Manager mutations
test/integrations/github*.test.ts	Tests for GitHub service and routes
.env.sample	Sample configuration for GitHub App credentials

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

The upgrade from argon2 ^0.28.7 to ^0.44.0 is a significant version jump. While argon2 is a stable library, this jump spans many major versions and could introduce breaking changes. Verify that:

1. The API remains compatible with existing password hashing/verification code
2. All existing password hashes can still be verified with the new version
3. The native bindings compile correctly in your deployment environment

This is particularly important since argon2 is a native module and version mismatches can cause runtime errors.

Suggested change

	"argon2": "^0.44.0",
	"argon2": "^0.28.7",

[Copilot]

The GraphQL query embeds the issueNumber directly into the query string using template literals (line 441). This creates a potential GraphQL injection vulnerability if issueNumber is not properly validated. Although issueNumber is typed as a number in the function signature, it should be passed as a GraphQL variable instead of being interpolated into the query string.

Change the query to use variables:

const repoInfoQuery = `
  query($owner: String!, $name: String!, $issueNumber: Int!) {
    repository(owner: $owner, name: $name) {
      id
      issue(number: $issueNumber) {
        id
      }
      // ... rest of query
    }
  }
`;

const repoInfo = await octokit.graphql<RepoInfoGraphQLResponse>(repoInfoQuery, {
  owner,
  name: repo,
  issueNumber,
});

This is a security best practice to prevent injection attacks.

[Copilot]

When updating an existing taskManager configuration (lines 377-385), the code spreads the existing project.taskManager.config but then only updates the installationId. This could potentially lose other config properties like delegatedUser if they exist. The safer approach would be:

taskManager: project.taskManager ? {
  ...project.taskManager,
  autoTaskEnabled: false,
  taskThresholdTotalCount: DEFAULT_TASK_THRESHOLD_TOTAL_COUNT,
  assignAgent: false,
  updatedAt: new Date(),
  config: {
    ...project.taskManager.config,
    installationId: installation_id,
  },
} : taskManagerConfig

This preserves all existing config properties while only updating the necessary fields.

[Copilot]

The test file duplicates the ProjectTaskManagerConfig type definition (lines 8-24) instead of importing it from @hawk.so/types. This creates a maintenance burden as changes to the actual type won't be reflected in tests. Since the comment on line 6 mentions "matching ProjectTaskManagerConfig from @hawk.so/types", this type should be imported directly:

import { ProjectDBScheme, ProjectTaskManagerConfig } from '@hawk.so/types';

Then remove the duplicate type definition.

Suggested change

	import { ProjectDBScheme } from '@hawk.so/types';
	/**
	* Task Manager configuration type (matching ProjectTaskManagerConfig from @hawk.so/types)
	*/
	type ProjectTaskManagerConfig = {
	type: 'github';
	autoTaskEnabled: boolean;
	taskThresholdTotalCount: number;
	assignAgent: boolean;
	usage?: {
	dayStartUtc: Date;
	autoTasksCreated: number;
	};
	connectedAt: Date;
	updatedAt: Date;
	config: {
	installationId: string;
	repoId: string | number;
	repoFullName: string;
	};
	};
	import { ProjectDBScheme, ProjectTaskManagerConfig } from '@hawk.so/types';

[Copilot]

The manual timing-safe comparison implementation is functionally correct but Node.js provides a built-in crypto.timingSafeEqual() function that is specifically designed for this purpose and is more robust. Consider replacing this manual implementation with:

const crypto = require('crypto');
// ... after calculating both signatures
const signatureValid = crypto.timingSafeEqual(
  Buffer.from(signature),
  Buffer.from(calculatedSignature)
);

This is the recommended approach for comparing security-sensitive values.