fix(github): drive public repo-stats allowlist from env instead of a hardcoded repo

[JSONbored]

Summary

• GET /v1/public/github/repos/:owner/:repo/stats looked like a generic, per-repo route but hard-rejected every repo except a literal jsonbored/gittensory via two hardcoded constants (PUBLIC_REPO_STATS_OWNER/PUBLIC_REPO_STATS_REPO). A self-hoster's own fork got a hard 400 invalid_github_repo on their own repo.
• Replaces the constants with PUBLIC_REPO_STATS_ALLOWLIST, a comma-separated owner/repo allowlist env var mirroring GITTENSORY_PUBLIC_STATS_REPOS's parsing shape in src/review/public-stats.ts. Empty/unset allows any syntactically-valid owner/repo (matching the sibling badge.svg route's any-repo behavior); setting it restricts the endpoint to specific repos.
• Also updates the stale OpenAPI response description that claimed "only JSONbored/gittensory is accepted" and regenerates apps/gittensory-ui/public/openapi.json accordingly.

Closes #4612

Scope

• The PR title follows type(scope): short summary Conventional Commit format, for example fix(api): restore profile access checks.
• This PR is focused and does not mix unrelated backend, UI, MCP, docs, dependency, and deploy changes.
• This follows CONTRIBUTING.md and does not reintroduce GitHub Pages, VitePress, site/, or CNAME.
• I linked a currently open issue this PR resolves (e.g. Closes #123) — a linked open issue is required for every contributor PR.

Validation

• git diff --check
• npm run actionlint
• npm run typecheck
• npm run test:coverage locally; codecov/patch requires ≥99% coverage of the lines AND branches you changed (aim for 100% on your diff so CI variance does not fail near the threshold). Global coverage is a non-blocking trend with a loose 90% backstop, not the gate.
• npm run test:workers
• npm run build:mcp
• npm run test:mcp-pack
• npm run ui:openapi:check
• npm run ui:lint
• npm run ui:typecheck
• npm run ui:build
• npm audit --audit-level=moderate
• New or changed behavior has unit/integration tests for new branches, fallback paths, and sanitizer boundaries

If any required check was skipped, explain why:

• Ran npx vitest run test/integration/api.test.ts test/unit/openapi.test.ts test/unit/auth.test.ts --coverage scoped to the changed source files (src/github/public.ts, src/openapi/spec.ts) instead of the full unsharded test:coverage; every changed line/branch in the diff shows nonzero hit counts on both sides. actionlint/test:workers/build:mcp/test:mcp-pack/ui:lint/ui:typecheck/ui:build are untouched by this change (no workflow, worker-pool, MCP, or UI source files changed) and are left to CI.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, private rankings, or private maintainer evidence are exposed.
• Public GitHub text stays sanitized, low-noise, and does not imply compensation guarantees or optimization tactics.
• Auth, cookie, CORS, GitHub App, Cloudflare, or session changes include negative-path tests.
• API/OpenAPI/MCP behavior is updated and tested where needed.
• UI changes use live API data or real empty/error/loading states, not production mock/demo fallbacks.
• Visible UI changes include a UI Evidence section below with JPG/JPEG or PNG screenshots arranged as organized, captioned, clickable thumbnails. SVG screenshots are not used as review evidence. Review-only screenshots or recordings are not committed to the repository.
• Public docs/changelogs are updated where needed; changelogs are only edited for release-prep PRs.

UI Evidence

Not applicable — backend-only change, no visible UI surface touched.

Notes

• Default behavior for JSONbored's own production call (/v1/public/github/repos/JSONbored/gittensory/stats) is unchanged: it is covered by the "allow any" default (no PUBLIC_REPO_STATS_ALLOWLIST set), and existing tests for that repo still pass unmodified.
• One pre-existing test (rejects non-allowlisted public GitHub repo stats paths before calling GitHub) asserted the old hardcoded-repo behavior with no allowlist configured; it is replaced by two tests that cover the new semantics explicitly: allow-any-when-unset, and reject-when-configured (including allowlist parsing of whitespace/casing/empty entries).

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	b6fbe52	Commit Preview URL Branch Preview URL	Jul 10 2026, 10:27 AM

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.12%. Comparing base (450e314) to head (b6fbe52).
⚠️ Report is 4 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4662   +/-   ##
=======================================
  Coverage   94.12%   94.12%           
=======================================
  Files         434      434           
  Lines       38496    38501    +5     
  Branches    14038    14040    +2     
=======================================
+ Hits        36233    36238    +5     
  Misses       1604     1604           
  Partials      659      659           

Files with missing lines	Coverage Δ
src/github/public.ts	96.96% <100.00%> (+0.24%)	⬆️
src/openapi/spec.ts	99.42% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[loopover-orb]

Tip

🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩🟩

✅ Gittensory review result - approve/merge recommended

_{Review updated: 2026-07-10 10:55:39 UTC}

5 files · 1 AI reviewer · no blockers · readiness 100/100 · CI green · clean

✅ Suggested Action - Approve/Merge

• safe to merge

Review summary
Replaces a hardcoded single-repo allowlist (PUBLIC_REPO_STATS_OWNER/REPO) with a PUBLIC_REPO_STATS_ALLOWLIST env var parsed the same way as the sibling GITTENSORY_PUBLIC_STATS_REPOS, so a self-hosted fork's own repo works without a code change while operators can still restrict the endpoint via env. The allowlist-empty case now permits any syntactically-valid owner/repo, matching the documented badge.svg behavior, and OpenAPI descriptions in both spec.ts and the generated openapi.json were updated to match. Tests replace the old single-repo-only rejection test with coverage for the unset (allow-any), configured-allowlist-allow, and configured-allowlist-reject paths, including whitespace/casing/empty-entry parsing.

Nits — 5 non-blocking

• src/github/public.ts: publicRepoFullName re-parses PUBLIC_REPO_STATS_ALLOWLIST on every call via publicRepoStatsAllowlist(env) instead of caching/memoizing it, which is wasteful if this route sees meaningful traffic (minor, not worth blocking on).
• The default-unset behavior change (previously effectively single-repo, now open to any owner/repo) is a real behavior shift for any existing deployment that hasn't set PUBLIC_REPO_STATS_ALLOWLIST — worth calling out explicitly in release notes even though it matches the sibling badge.svg route and issue Fix public repo-stats endpoint hardcoded to jsonbored/gittensory only #4612's intent.
• Consider a short CHANGELOG or deploy-notes mention that self-hosters wanting to keep the old single-repo restriction must now explicitly set PUBLIC_REPO_STATS_ALLOWLIST, since the default posture flips from restrictive to permissive.
• test/integration/api.test.ts's allowlist test already exercises trim/case/empty-entry parsing well; no changes needed there.
• PR author also opened the linked issue — Link an issue that was opened by a different contributor, or provide a rationale for why this self-authored issue represents genuine discovery work.

Signal	Result	Evidence
Code review	✅ No blockers	1 reviewer
Linked issue	✅ Linked	#4612
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (1 linked issue).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 48 registered-repo PR(s), 40 merged, 330 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 48 PR(s), 330 issue(s).
Gate result	✅ Passing	No configured blocker found.

Review context

• Author: JSONbored
• Role context: owner (maintainer lane)
• Public audience mode: oss maintainer
• Lane context: Repository is configured for direct PR review.
• Public profile languages: not available
• Official Gittensor activity: 48 PR(s), 330 issue(s).
• PR-specific overlap: none found.

Contributor next steps

• Treat this as maintainer-lane context rather than normal contributor-lane activity.

Signal definitions

• Related work = same linked issue, overlapping active PRs, or title/path similarity.
• Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
• Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
• Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
• Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

Visual preview

Route	Viewport	Before (production)	After (this PR's preview)	Diff
/	desktop			—
/	mobile			—

Click any thumbnail to open the full-size screenshot. Before = production · After = this PR's preview deploy.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

• Re-run Gittensory review