Fix: bound automatic PR synchronize reviews and cancel stale jobs

[petergstfsn]

Motivation

• Prevent untrusted external contributors from repeatedly triggering paid review work by pushing new commits (every synchronize) and thereby consuming model and queue resources.
• Ensure queued jobs do not perform expensive model calls or repository writes after the PR head has moved, avoiding duplicate reviews and wasted budget.

Description

• Preserve GitHub author association during webhook normalization and schema by adding author_association / authorAssociation to webhook payload types and the normalization output (packages/schema/*, packages/provider-github/src/webhook.ts).
• Reject automatic change_request/synchronize review extraction for authors without a trusted repository role (OWNER, MEMBER, COLLABORATOR) in extractReviewRequest, so untrusted fork pushes are acknowledged but not queued (packages/core/src/review/request.ts).
• Short-circuit the API webhook route to acknowledge and ignore synchronize deliveries that were rejected by policy before persisting or enqueueing work (packages/api/src/routes/webhook.ts).
• Add stale-head cancellation: cancel jobs whose stored commitSha no longer matches the current PR head in preparation (runPreparePhase) and revalidate before any later phase so stale queue entries do not perform diffs, model calls, checks, or reviews (packages/core/src/review/prepare.ts, packages/core/src/review/index.ts).
• Add a cancelJob method to the job store port and wire it through the DB repository and in-memory test runtime (packages/core/src/ports/jobs.ts, packages/db/src/repositories/jobs-repository.ts, packages/core/test/in-memory.ts).
• Add regression tests covering ignored untrusted synchronize events, allowed collaborator synchronize events, and stale-job cancellation (test/api/webhook-handling.spec.ts, packages/core/test/stale-job.spec.ts).

Testing

• Ran the webhook handling suite: npx vitest run test/api/webhook-handling.spec.ts --reporter=dot, all tests passed.
• Ran core stale-job tests: npm test -w @codraoss/core -- --run test/stale-job.spec.ts --reporter=verbose, tests passed.
• Ran typecheck and lint: npm run typecheck -- --pretty false and npm run lint -- --no-warn-ignored, both completed without errors.
• Verified repository formatting: git diff --check returned no whitespace errors.

---

Codex Task

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Updated (UTC)
✅ Deployment successful! View logs	codra	9f5cca3	Sep 22 2026, 04:17 AM