feat: switched default github auth to ssh

Author: jahilldev

api/prisma/dev.db

@@ -30,17 +30,23 @@ export class WebhookController {
     @Headers(SIGNATURE_HEADER) signature: string,
   ): Promise<{ ok: true }> {
     const raw = req.rawBody?.toString('utf8');
+
     if (!raw) {
       throw new BadRequestException('missing raw body');
     }
+
     const valid = verifySignature(this.config.get('GITHUB_WEBHOOK_SECRET'), raw, signature);
+    
     if (!valid) {
       throw new UnauthorizedException('invalid signature');
     }
+
     if (!event || !delivery) {
       throw new BadRequestException('missing event or delivery headers');
     }
+
     await this.webhooks.handle(event, delivery, raw, req.body as unknown);
+   
     return { ok: true };
   }
 }

api/src/webhook/webhook.controller.ts

@@ -1,9 +1,8 @@
 import { Module } from '@nestjs/common';
-import { GithubModule } from '../github/github.module.js';
 import { WorkspaceService } from './workspace.service.js';
 
 @Module({
-  imports: [GithubModule],
+  imports: [],
   providers: [WorkspaceService],
   exports: [WorkspaceService],
 })

api/src/workspace/workspace.module.ts

@@ -4,10 +4,9 @@ import { mkdir, rm } from 'node:fs/promises';
 import { Injectable, Logger } from '@nestjs/common';
 import { simpleGit, type SimpleGit } from 'simple-git';
 import { AppConfigService } from '../config/config.service.js';
-import { GithubService } from '../github/github.service.js';
 import { type DiffSummary, type Workspace, type WorkspacePrepareInput } from './workspace.model.js';
 import {
-  authenticatedRemoteUrl,
+  sshRemoteUrl,
   changedFilesFromStatus,
   workspaceDir,
 } from './workspace.utility.js';
@@ -21,17 +20,13 @@ import {
 export class WorkspaceService {
   private readonly logger = new Logger(WorkspaceService.name);
 
-  constructor(
-    private readonly config: AppConfigService,
-    private readonly app: GithubService,
-  ) {}
+  constructor(private readonly config: AppConfigService) {}
 
   /** Clone (if needed) and check out the job's branch. Idempotent across attempts. */
   async prepare(input: WorkspacePrepareInput): Promise<Workspace> {
     const root = this.config.get('WORKSPACE_ROOT');
     const dir = workspaceDir(root, input.jobId);
-    const token = await this.app.getInstallationToken(input.installationId);
-    const remote = authenticatedRemoteUrl(input.owner, input.repo, token);
+    const remote = sshRemoteUrl(input.owner, input.repo);
 
     if (existsSync(`${dir}/.git`)) {
       const git = simpleGit(dir);
@@ -86,13 +81,11 @@ export class WorkspaceService {
     return (await git.revparse(['HEAD'])).trim();
   }
 
-  /** Push the job branch, refreshing the remote token first (tokens expire ~1h). */
+  /** Push the job branch using the host machine's SSH credentials. */
   async push(input: WorkspacePrepareInput): Promise<string> {
     const root = this.config.get('WORKSPACE_ROOT');
     const dir = workspaceDir(root, input.jobId);
     const git = simpleGit(dir);
-    const token = await this.app.getInstallationToken(input.installationId);
-    await git.remote(['set-url', 'origin', authenticatedRemoteUrl(input.owner, input.repo, token)]);
     await git.push(['-u', 'origin', input.branchName]);
     const sha = (await git.revparse(['HEAD'])).trim();
     this.logger.log(`[job ${input.jobId}] pushed ${input.branchName} @ ${sha}`);

api/src/workspace/workspace.service.ts

@@ -5,9 +5,9 @@ export function workspaceDir(root: string, jobId: string): string {
   return resolve(root, jobId);
 }
 
-/** HTTPS remote URL carrying a short-lived installation token. */
-export function authenticatedRemoteUrl(owner: string, repo: string, token: string): string {
-  return `https://x-access-token:${token}@github.com/${owner}/${repo}.git`;
+/** SSH remote URL — authentication is handled by the host machine's SSH credentials. */
+export function sshRemoteUrl(owner: string, repo: string): string {
+  return `git@github.com:${owner}/${repo}.git`;
 }
 
 /** Files touched in the working tree, from a simple-git StatusResult. */