fix(events): omit GitLab webhook tokens from errors

[chenrui333]

What

Omit the supplied GitLab webhook token from authentication errors.

Why

These errors are written to logs and returned in HTTP responses.

Testing

Rejection regression fails before the fix; validator and events-controller package tests pass.

[Copilot]

🟢 Approval recommended

The change is narrowly scoped to removing sensitive token data from error strings and includes regression tests that verify the non-leak behavior.

Pull request overview

This PR updates the GitLab webhook request validator to avoid leaking webhook token values in authentication error messages, preventing accidental disclosure via logs and HTTP responses.

Changes:

• Removed the supplied X-Gitlab-Token value from the “did not match expected secret” error message.
• Updated the invalid-secret regression test to assert that neither the configured secret nor the client-supplied token appears in the error text (and that rejection happens before body parsing).

File summaries

File	Description
server/controllers/events/gitlab_request_parser_validator.go	Sanitizes the secret-mismatch error message to omit webhook token values.
server/controllers/events/gitlab_request_parser_validator_test.go	Strengthens tests to ensure token values are not present in errors and auth fails before parsing.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-code-quality]

Code Coverage Overview

Languages: Go

Go / code-coverage/go

The overall line coverage in commit 86919fb in the fix/gitlab-webhook-t... branch is 73%. Line coverage data for the main branch is not yet available.

Show a line coverage summary of the most covered files.

File	main	fix/gitlab-webhook-t... 86919fb	+/-
server/events/v...ithub/client.go	—	88%	—
server/core/ter...aform_client.go	—	88%	—
server/controll...i_controller.go	—	83%	—
server/events/p...mand_builder.go	—	83%	—
server/events/v...itlab/client.go	—	80%	—
server/events/p...mmand_runner.go	—	76%	—
server/events/event_parser.go	—	76%	—
server/events/working_dir.go	—	73%	—
server/server.go	—	70%	—
server/controll...s_controller.go	—	64%	—

---

_{Updated September 07, 2026 23:51 UTC}