Unified per-assignment student repository configuration (#698, #699, #700)

.github/workflows/deploy.yml

@@ -76,7 +76,7 @@ jobs:
         with:
           # Pin to a known-good version. `latest` makes runs non-reproducible —
           # bump deliberately when we want a new CLI.
-          version: 2.92.1
+          version: 2.105.0
 
       - name: Install dependencies
         run: npm ci
@@ -103,6 +103,10 @@ jobs:
           E2E_ENABLE=true
           END_TO_END_SECRET=not-a-secret
           EDGE_FUNCTION_SECRET=some-secret-value
+          # Auth gate for the github-repo-webhook EventBridge envelope. Lets the
+          # webhook-direct e2e (push-no-autograder, pr-webhook-ingest) authenticate
+          # and run in CI; no real GitHub (E2E repos resolve via getRepoToCloneConsideringE2E).
+          EVENTBRIDGE_SECRET=some-eventbridge-secret
           GITHUB_APP_ID=${GITHUB_APP_ID}
           GITHUB_OAUTH_CLIENT_ID=${GITHUB_OAUTH_CLIENT_ID}
           GITHUB_OAUTH_CLIENT_SECRET=${GITHUB_OAUTH_CLIENT_SECRET}

AGENTS.md

@@ -22,12 +22,7 @@ Pawtograder is a Next.js 15 + Supabase course operations platform (autograder, h
      1. If Supabase is already running, stop it WITHOUT a backup: `npx supabase stop --no-backup` (this deletes the stale volume).
      2. Also delete any leftover project volumes just to be safe: `docker volume ls --filter label=com.supabase.cli.project=pawtograder-platform -q | xargs -r docker volume rm`.
      3. Start fresh: `npx supabase start` — this will run every migration in `supabase/migrations/` against an empty DB.
-   - **Known migration issue**: Migration `20260217000000_binary_submission_files.sql` fails during `supabase start` with `must be owner of table objects` because it creates RLS policies on `storage.objects`. Workaround (do this every fresh start):
-     1. Before `supabase start`, move the file aside: `mv supabase/migrations/20260217000000_binary_submission_files.sql /tmp/`.
-     2. Run `npx supabase start`.
-     3. Apply it as superuser: `docker exec -i supabase_db_pawtograder-platform psql -U postgres -d postgres < /tmp/20260217000000_binary_submission_files.sql`.
-     4. Record it: `docker exec -i supabase_db_pawtograder-platform psql -U postgres -d postgres -c "INSERT INTO supabase_migrations.schema_migrations (version, name) VALUES ('20260217000000', 'binary_submission_files') ON CONFLICT DO NOTHING;"`.
-     5. Restore the file: `mv /tmp/20260217000000_binary_submission_files.sql supabase/migrations/`.
+   - **Storage RLS policies & the Supabase CLI version (IMPORTANT — pinned to `2.105.0`)**: storage bucket policies (avatars, uploads, submission-files) live **inline** in their migrations as plain `CREATE POLICY ... ON storage.objects`; no post-start superuser step is needed. This requires the pinned CLI: `supabase` is pinned to `2.105.0` in `package.json` (matching `.github/workflows/deploy.yml`), and `npx supabase` resolves that local devDep — don't run a globally-installed older CLI. On **older CLIs (e.g. 2.77.0)**, `supabase db reset` fails partway with `ERROR: must be owner of table objects` on the _later_ storage-policy migrations (e.g. `20260530120200`, `20260217000000`) while _earlier_ ones (avatars/uploads) succeed in the same run. Root cause is a race between the CLI's migration runner and the storage container re-owning `storage.objects` to `supabase_storage_admin` mid-reset — not the policy SQL itself (the same statement run interactively as `postgres` succeeds). CLI `2.105.0` applies all of them cleanly in both `supabase start` and `db reset`. If you hit `must be owner` on a fresh start, you're on the wrong CLI version — `rm -rf node_modules/.bin/supabase && npm install` (or `npm install supabase@2.105.0 -D`).
    - **Audit partitions**: The partitioned `public.audit` table only has partitions for a narrow date range out of migrations. If the current date is outside that range, inserts fail with `no partition of relation "audit" found for row`. After starting Supabase, run `docker exec -i supabase_db_pawtograder-platform psql -U postgres -d postgres -c "SELECT public.audit_maintain_partitions();"` to create today's partition (and the next 7 days).
    - **Sanity check the schema is current** before running E2E: the newest row of `supabase_migrations.schema_migrations` should match the newest file under `supabase/migrations/` (e.g. `20260413234500`). If it doesn't, the DB was restored from a backup — redo the stop/restart-without-backup sequence above.
 3. **Configure `.env.local`**: After `supabase start`, get keys with `npx supabase status -o env` and set `NEXT_PUBLIC_SUPABASE_URL`, `NEXT_PUBLIC_SUPABASE_ANON_KEY`, `SUPABASE_SERVICE_ROLE_KEY`, `SUPABASE_URL`, and `ENABLE_SIGNUPS=true`.
@@ -96,3 +91,23 @@ Convenience: `npm run cli:repos -- …` (same as `npm run cli -- repos …`). Ad
 - The staging Supabase backend (`.env.local.staging`) has signups disabled; use local Supabase for full dev.
 - Docker in this cloud VM requires `fuse-overlayfs` storage driver and `iptables-legacy`. These are configured during initial setup.
 - Edge Functions should be started with `.env.local` when needed: `npx supabase functions serve --env-file .env.local`.
+
+### GitHub App webhook subscription (ACTION REQUIRED for deployment ingestion)
+
+The App-level webhook event subscription lives in the **GitHub App settings UI**, not in this repo
+(there is no app manifest/IaC). The authoritative list of events Pawtograder handlers expect is
+`GITHUB_APP_WEBHOOK_EVENTS` in `supabase/functions/github-repo-configure-webhook/index.ts`. When you add
+a handler in `github-repo-webhook/index.ts`, add the event there **and** subscribe the App to it.
+
+**Deployment ingestion (`github_deployments`, PR-submission-mode Phase 4)** needs the App subscribed to
+**Deployment** and **Deployment status** — until then no `deployment_status` deliveries arrive and the
+table stays empty (the ingestion code + table are already in place). To enable (needs org/App admin):
+
+1. GitHub → the org's **Pawtograder GitHub App** → **Settings** → **Permissions & events**.
+2. Ensure the **Deployments** repository permission is granted (Read-only is enough), then under
+   **Subscribe to events** check **Deployment** and **Deployment status**. Save (re-accept the permission
+   prompt on installations if shown).
+3. **Verify:** trigger a deployment on a tracked repo (or replay a `deployment_status` delivery from the
+   App's **Advanced → Recent Deliveries**), then confirm a row lands:
+   `docker exec -i supabase_db_pawtograder-platform psql -U postgres -d postgres -c "select repository_name, environment, state from public.github_deployments order by id desc limit 5;"`
+   (locally) or query `github_deployments` on the target environment.

CLAUDE.md

@@ -63,6 +63,6 @@ The `TableController` class manages data caching and loading, scoped to a contex
 
 ### Key Conventions
 
-- `@/*` path alias maps to project root.
+- `@/*` path alias maps to project root. This alias applies only to Next.js/Node.js code; it does **not** work in Deno. Files under `supabase/functions/` are Deno edge functions and must use relative (`./foo.ts`) or URL-based imports, not `@/*`.
 - Copy `.env.local.staging` to `.env.local` for frontend-only dev against staging. Signups disabled on staging; use local Supabase for full dev.
 - Seeded test users have password `change-it`. Include "instructor" in email for instructor role.

app/api/metrics/route.ts

@@ -5,7 +5,7 @@
 // when monitoring.enabled=true. Without the env var set the endpoint
 // returns 503 so we don't leak metrics on hostile networks.
 
-import { timingSafeEqual } from "node:crypto";
+import { createHash, timingSafeEqual } from "node:crypto";
 import { getMetrics, refreshWorkflowMetrics } from "@/lib/metrics";
 
 // prom-client uses Node-only APIs (process.cpuUsage, V8 GC hooks).
@@ -20,14 +20,12 @@ function isAuthorized(headerValue: string | null): boolean {
   const m = headerValue.match(/^Bearer\s+(.+)$/);
   if (!m) return false;
   const presented = m[1];
-  // Pad to the longer of the two so timingSafeEqual doesn't throw on
-  // length mismatch (which itself is timing-revealing).
-  const len = Math.max(expected.length, presented.length);
-  const a = Buffer.alloc(len);
-  const b = Buffer.alloc(len);
-  a.write(expected);
-  b.write(presented);
-  return timingSafeEqual(a, b) && expected.length === presented.length;
+  // Constant-time compare. Hash both sides to fixed-length digests so this is correct for
+  // multi-byte/unicode tokens (Buffer.alloc(charLength)+write truncates UTF-8, which could make
+  // two different tokens compare equal) and never throws on a length mismatch.
+  const a = createHash("sha256").update(expected).digest();
+  const b = createHash("sha256").update(presented).digest();
+  return timingSafeEqual(a, b);
 }
 
 export async function GET(req: Request): Promise<Response> {

app/course/[course_id]/assignments/[assignment_id]/manageGroupWidget.tsx

@@ -916,10 +916,14 @@ function RepositoriesInfo({ repositories }: { repositories: Repository[] }) {
 
 export default function ManageGroupWidget({
   assignment,
-  repositories
+  repositories,
+  showRepositories = true
 }: {
   assignment: Assignment;
   repositories: Repository[];
+  // Hidden for repo-less modes (none / no_submission), where group management
+  // still applies but there are no Git repositories to link.
+  showRepositories?: boolean;
 }) {
   const { private_profile_id } = useClassProfiles();
   const { time_zone } = useCourse();
@@ -941,7 +945,7 @@ export default function ManageGroupWidget({
         <Text fontSize="sm" color="fg.muted">
           You will not be able to join a group for this assignment.
         </Text>
-        <RepositoriesInfo repositories={repositories} />
+        {showRepositories && <RepositoriesInfo repositories={repositories} />}
       </Box>
     );
   }
@@ -1016,7 +1020,7 @@ export default function ManageGroupWidget({
         {description}
       </Text>
       {actions}
-      <RepositoriesInfo repositories={repositories} />
+      {showRepositories && <RepositoriesInfo repositories={repositories} />}
     </Box>
   );
 }

app/course/[course_id]/assignments/[assignment_id]/page.tsx

@@ -28,8 +28,10 @@ import { CrudFilter, useList } from "@refinedev/core";
 import { format, secondsToHours } from "date-fns";
 import { useParams } from "next/navigation";
 import { useEffect, useMemo, useRef } from "react";
+import UploadSubmission from "@/components/submissions/upload-submission";
 import { CommitHistoryDialog } from "./commitHistory";
 import ManageGroupWidget from "./manageGroupWidget";
+import PrSubmissionPanel from "./prSubmissionPanel";
 
 export default function AssignmentPage() {
   const { course_id, assignment_id } = useParams();
@@ -60,7 +62,7 @@ export default function AssignmentPage() {
     }
     return filters;
   }, [assignment_id, assignmentGroup, private_profile_id]);
-  const { data: submissionsData } = useList<SubmissionWithGraderResultsAndReview>({
+  const { data: submissionsData, refetch: refetchSubmissions } = useList<SubmissionWithGraderResultsAndReview>({
     resource: "submissions",
     meta: {
       select:
@@ -111,6 +113,11 @@ export default function AssignmentPage() {
   if (!assignment) {
     return <Skeleton height="40" width="100%" />;
   }
+  // No-repo / no-submission / PR-mode assignments have no autograder by
+  // convention, so an autograder score is not meaningful — show "N/A" instead
+  // of progress/score.
+  const isPrMode = assignment.submission_mode === "pr";
+  const noAutograder = assignment.repo_mode === "none" || assignment.repo_mode === "no_submission" || isPrMode;
   return (
     <Box p={4}>
       <LinkAccount />
@@ -138,7 +145,29 @@ export default function AssignmentPage() {
 
           <Markdown>{assignment.description}</Markdown>
 
-          {!assignment.template_repo || !assignment.template_repo.includes("/") ? (
+          {isPrMode && (
+            <PrSubmissionPanel
+              assignment={assignment}
+              assignmentGroupId={assignmentGroup?.id}
+              profileId={enrollment?.private_profile_id}
+              onConfirmed={() => refetchSubmissions()}
+            />
+          )}
+
+          {isPrMode ? (
+            <></>
+          ) : assignment.repo_mode === "none" ? (
+            <UploadSubmission assignmentId={Number(assignment_id)} onUploaded={() => refetchSubmissions()} />
+          ) : assignment.repo_mode === "no_submission" ? (
+            <Alert.Root status="info" flexDirection="column" m={4} maxW="4xl">
+              <Alert.Title>No submission required</Alert.Title>
+              <Alert.Description>
+                There is nothing to submit here. Your instructor will grade this assignment manually (for example, a
+                presentation or oral exam). Complete the task as your instructor described — your grade will appear
+                below once it is released.
+              </Alert.Description>
+            </Alert.Root>
+          ) : !assignment.template_repo || !assignment.template_repo.includes("/") ? (
             <Alert.Root status="error" flexDirection="column">
               <Alert.Title>No repositories configured for this assignment</Alert.Title>
               <Alert.Description>
@@ -151,7 +180,13 @@ export default function AssignmentPage() {
             <></>
           )}
           <Box m={4} borderWidth={1} borderColor="bg.emphasized" borderRadius={4} p={4} bg="bg.subtle" maxW="4xl">
-            <ManageGroupWidget assignment={assignment} repositories={repositories ?? []} />
+            <ManageGroupWidget
+              assignment={assignment}
+              repositories={repositories ?? []}
+              showRepositories={
+                !isPrMode && assignment.repo_mode !== "none" && assignment.repo_mode !== "no_submission"
+              }
+            />
           </Box>
           <SelfReviewNotice
             review_settings={review_settings ?? ({} as SelfReviewSettings)}
@@ -232,17 +267,30 @@ export default function AssignmentPage() {
                     </Link>
                   </Table.Cell>
                   <Table.Cell>
-                    <Link href={`https://github.com/${submission.repository}/commit/${submission.sha}`}>
-                      {submission.sha.slice(0, 7)}
-                    </Link>
+                    {submission.submitted_via === "pr" && submission.repository && submission.pr_number ? (
+                      <Link href={`https://github.com/${submission.repository}/pull/${submission.pr_number}`}>
+                        #{submission.pr_number}
+                        {submission.sha ? ` (${submission.sha.slice(0, 7)})` : ""}
+                      </Link>
+                    ) : submission.sha && submission.repository ? (
+                      <Link href={`https://github.com/${submission.repository}/commit/${submission.sha}`}>
+                        {submission.sha.slice(0, 7)}
+                      </Link>
+                    ) : submission.submitted_via === "manual" ? (
+                      <span>Manual</span>
+                    ) : (
+                      <span>Upload</span>
+                    )}
                   </Table.Cell>
                   <Table.Cell>
                     <Link href={`/course/${course_id}/assignments/${assignment_id}/submissions/${submission.id}`}>
-                      {!submission.grader_results
-                        ? "In Progress"
-                        : submission.grader_results && submission.grader_results.errors
-                          ? "Error"
-                          : `${submission.grader_results?.score}/${submission.grader_results?.max_score}`}
+                      {noAutograder
+                        ? "N/A"
+                        : !submission.grader_results
+                          ? "In Progress"
+                          : submission.grader_results && submission.grader_results.errors
+                            ? "Error"
+                            : `${submission.grader_results?.score}/${submission.grader_results?.max_score}`}
                     </Link>
                   </Table.Cell>
                   <Table.Cell>