#424 fix(ui): address GitHub Advanced Security findings from PR #416

[Anonymous]

Originally created by: Akarsh-Hegde

Summary

Fixes the two GitHub Advanced Security / code-quality findings left on [#416] ("promote: pre-main → main"):

• ui/__tests__/popover-health-panel.test.ts (CodeQL: bad HTML filtering regexp / incomplete multi-character sanitization) — the <script>-stripping regex only matched an exact </script> close tag in a single non-looping pass. Now tolerates attributes on the open tag and whitespace before the closing > (e.g. </script >), and loops to a fixed point.
• ui/components/IntegrationConnect.tsx (code-quality: useless conditional) — GitHubProjectPicker's inline error paragraph next to the Save button was dead code: it shared the same error state as the initial-load early return, which always short-circuits first once that state is set. Split into loadError/saveError so a save failure now actually surfaces inline instead of being masked — and no longer wipes out the user's board selection by falling through to the full-page error view.

Test plan

• [x] bun test in ui/ — 243 pass, 0 fail (was 8/8 for the touched popover test, confirmed unaffected)
• [x] bun test __tests__/oauth-setup-lifecycle.test.ts (references IntegrationConnect) — 8/8 pass
• [x] npx tsc --noEmit — no new errors introduced

Once merged, pre-main's promotion into [#416] will pick this up automatically since [#416]'s head is pre-main.

🤖 Generated with Claude Code

[Anonymous]

Originally posted by: coderabbitai[bot]

[!IMPORTANT]

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: caa58fad-91df-4613-9eb8-7e355bc1bad1

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:
- [ ] 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/pr416-security-review-findings`

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed