fix(github-app): PAT fallback covers every mint failure; video/motion/x cleanups

mint_installation_token now wraps JWT build + HTTP + parsing so raw
httpx/jwt failures surface as GitHubAppError and the existing PAT
fallback catches them all (a GitHub outage no longer crashes git
operations for App-bound projects). The PEM is validated at
credential-set time instead of first mint, and the installation-token
cache is cleared when credentials are deleted. Also: the video
preview root resolves symlinks like its sibling route (frames under a
symlinked workspaces_root no longer false-404), the tracked dangling
motion/node_modules symlink is removed and the gitignore gains a
slash-less entry that actually matches symlinks, changelog caption
input strips GHSA refs like PR refs, and the edit-project dialog hides
the GitHub App section for auto-detected gitlab.com projects and warns
before a save that would clear both auth sources.

tests/integration/test_github_app_credentials_service.py

@@ -10,6 +10,8 @@ from typing import TYPE_CHECKING
 
 import pytest
 import pytest_asyncio
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from roboco.db.tables import GitHubAppCredentialsTable
 from roboco.services.github_app_credentials import (
     GitHubAppCredentialsService,
@@ -23,9 +25,19 @@ if TYPE_CHECKING:
 
     from sqlalchemy.ext.asyncio import AsyncSession
 
+
+def _generate_rsa_pem() -> str:
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode()
+
+
 _CREDS = {
     "app_id": "123456",
-    "private_key": "-----BEGIN PRIVATE KEY-----\nfake-pem\n-----END PRIVATE KEY-----",
+    "private_key": _generate_rsa_pem(),
 }
 
 
@@ -88,9 +100,16 @@ async def test_rotate_overwrites_previous_values(
     svc: GitHubAppCredentialsService,
 ) -> None:
     await svc.set_credentials(**_CREDS)
-    rotated = {"app_id": "654321", "private_key": _CREDS["private_key"] + "-rotated"}
+    rotated = {"app_id": "654321", "private_key": _generate_rsa_pem()}
     await svc.set_credentials(**rotated)
     decrypted = await svc.get_decrypted()
     assert decrypted is not None
     assert decrypted.app_id == rotated["app_id"]
     assert decrypted.private_key == rotated["private_key"]
+
+
+@pytest.mark.asyncio
+async def test_malformed_pem_is_rejected(svc: GitHubAppCredentialsService) -> None:
+    with pytest.raises(GitHubAppCredentialsValidationError):
+        await svc.set_credentials(app_id="123456", private_key="not-a-pem-at-all")
+    assert await svc.has_credentials() is False

tests/integration/test_github_app_routes.py

@@ -15,6 +15,8 @@ from uuid import UUID, uuid4
 
 import pytest
 import pytest_asyncio
+from cryptography.hazmat.primitives import serialization
+from cryptography.hazmat.primitives.asymmetric import rsa
 from fastapi import FastAPI
 from httpx import ASGITransport, AsyncClient
 from roboco.api.deps import get_agent_context, get_db
@@ -34,6 +36,18 @@ if TYPE_CHECKING:
     from sqlalchemy.ext.asyncio import AsyncSession
 
 
+def _generate_rsa_pem() -> str:
+    private_key = rsa.generate_private_key(public_exponent=65537, key_size=2048)
+    return private_key.private_bytes(
+        encoding=serialization.Encoding.PEM,
+        format=serialization.PrivateFormat.PKCS8,
+        encryption_algorithm=serialization.NoEncryption(),
+    ).decode()
+
+
+_VALID_PEM = _generate_rsa_pem()
+
+
 def _build_app(db_session: AsyncSession, role: AgentRole, agent_id: UUID) -> FastAPI:
     app = FastAPI()
     app.include_router(github_app_router, prefix="/api/github-app")
@@ -71,14 +85,11 @@ async def test_set_credentials_reports_status_never_plaintext(
 ) -> None:
     resp = await ceo_client.put(
         "/api/github-app/credentials",
-        json={
-            "app_id": "123456",
-            "private_key": "-----BEGIN KEY-----\nsecretpem\n-----END KEY-----",
-        },
+        json={"app_id": "123456", "private_key": _VALID_PEM},
     )
     assert resp.status_code == HTTPStatus.OK
     assert resp.json() == {"has_credentials": True}
-    assert "secretpem" not in resp.text
+    assert _VALID_PEM.splitlines()[1] not in resp.text
 
     status_resp = await ceo_client.get("/api/github-app/credentials")
     assert status_resp.json()["has_credentials"] is True
@@ -93,11 +104,28 @@ async def test_partial_credentials_is_400(ceo_client: AsyncClient) -> None:
     assert resp.status_code == HTTPStatus.BAD_REQUEST
 
 
+@pytest.mark.asyncio
+async def test_malformed_pem_is_400(ceo_client: AsyncClient) -> None:
+    # Compares before/after rather than asserting an absolute False: routes
+    # commit directly (unlike the service-layer tests' rolled-back flush),
+    # so an earlier test in this module may have already left credentials
+    # set — the contract under test is "a rejected PUT changes nothing".
+    before = await ceo_client.get("/api/github-app/credentials")
+    resp = await ceo_client.put(
+        "/api/github-app/credentials",
+        json={"app_id": "123456", "private_key": "not-a-real-pem"},
+    )
+    assert resp.status_code == HTTPStatus.BAD_REQUEST
+
+    after = await ceo_client.get("/api/github-app/credentials")
+    assert after.json() == before.json()
+
+
 @pytest.mark.asyncio
 async def test_clear_credentials(ceo_client: AsyncClient) -> None:
     await ceo_client.put(
         "/api/github-app/credentials",
-        json={"app_id": "123456", "private_key": "pem-body"},
+        json={"app_id": "123456", "private_key": _VALID_PEM},
     )
     resp = await ceo_client.delete("/api/github-app/credentials")
     assert resp.status_code == HTTPStatus.OK
@@ -107,6 +135,17 @@ async def test_clear_credentials(ceo_client: AsyncClient) -> None:
     assert status_resp.json()["has_credentials"] is False
 
 
+@pytest.mark.asyncio
+async def test_clear_credentials_clears_token_cache(ceo_client: AsyncClient) -> None:
+    """Deleting the App credentials must drop any cached installation
+    token — otherwise a revoked/replaced App keeps serving a stale token
+    until the cache entry's own expiry."""
+    with patch("roboco.api.routes.github_app.clear_token_cache") as mock_clear:
+        resp = await ceo_client.delete("/api/github-app/credentials")
+    assert resp.status_code == HTTPStatus.OK
+    mock_clear.assert_called_once()
+
+
 @pytest.mark.asyncio
 async def test_installations_not_configured_is_409(ceo_client: AsyncClient) -> None:
     with patch(

tests/integration/test_video_routes.py

@@ -1456,18 +1456,33 @@ async def test_preview_frame_non_ceo_is_forbidden(db_session: AsyncSession) -> N
     app.dependency_overrides.clear()
 
 
-def test_resolve_preview_path_confines_frame_orientation_traversal(
-    tmp_path: Path,
+def test_previews_root_confines_frame_orientation_traversal_through_symlink(
+    tmp_path: Path, monkeypatch: pytest.MonkeyPatch
 ) -> None:
-    """The preview-frame route composes ``f"{orientation}/{filename}"`` before
-    calling ``_resolve_preview_path`` — same confinement the composition-HTML
-    proxy uses, applied to a task's .previews/ dir instead of its read-clone."""
-    root = (tmp_path / "roboco-x" / ".previews" / "abcd1234").resolve()
-    (root / "vertical").mkdir(parents=True)
-    frame = root / "vertical" / "frame-01-of-1-at-0.5s.png"
+    """Drives the REAL ``_previews_root`` -> ``_resolve_preview_path`` chain
+    (the preview-frame route composes ``f"{orientation}/{filename}"`` before
+    calling ``_resolve_preview_path``) with an UNRESOLVED, symlinked
+    ``workspaces_root`` — the container-mount shape. Before ``_previews_root``
+    resolved its own path, the ``is_relative_to`` confinement check compared a
+    resolved candidate against an unresolved root and 404'd every legit
+    frame; this proves a real frame under the symlink still serves while
+    traversal is still rejected."""
+    real_root = tmp_path / "real-workspaces"
+    real_root.mkdir()
+    symlinked_root = tmp_path / "workspaces-symlink"
+    symlinked_root.symlink_to(real_root)
+    monkeypatch.setattr(cfg, "workspaces_root", str(symlinked_root))
+
+    task_id = uuid4()
+    project_slug = "roboco-x"
+    frame_dir = real_root / project_slug / ".previews" / task_id.hex[:8] / "vertical"
+    frame_dir.mkdir(parents=True)
+    frame = frame_dir / "frame-01-of-1-at-0.5s.png"
     frame.write_bytes(b"png")
     secret = tmp_path / "secret.png"
     secret.write_bytes(b"nope")
+
+    root = video_module._previews_root(project_slug, task_id)
     assert (
         video_module._resolve_preview_path(root, "vertical/frame-01-of-1-at-0.5s.png")
         == frame.resolve()