#496 fix(integrations): refuse a submitted placeholder over a stored token

[Anonymous]

Originally created by: Akarsh-Hegde

Resolves the review comments left on [#495]. Opened against pre-main because [#495]'s head is pre-main - commits cannot be pushed onto it directly, so the fixes land here and flow into that promotion.

The one that matters: credential corruption

missing_required judged a submitted key by falling back to what .env already held. A placeholder like your-token-here is not "set", but a valid token on disk satisfied the requirement - so validation passed, and since upsert_env writes every submitted key verbatim, the placeholder landed on top of the working credential.

// before - `existing` rescues a key the payload got wrong
let submitted = updates.get(*k).is_some_and(|v| value_is_set(v));
!submitted && !is_set(existing, k)

The check now judges the payload's value and only that when a key is submitted, and consults .env only when the key is absent. That fallback is exactly what the GitHub project picker from [#493] needs (it submits project_ids alone on top of an OAuth-written token), so it is preserved for that case and no other.

The existing test could not have caught this - a_submitted_placeholder_token_is_refused_like_a_stored_one passes an empty .env, so it held under the old logic too. The new test supplies a valid stored token and fails without the fix (verified by reverting the logic and re-running).

Also fixed

• detect_install_mode called twice per save. Synchronous filesystem probing, twice, for the same answer, in an async command. Resolved once and reused.
• Self-referential workflow comments. The parallel-build fold left two comments naming release-staging.yml from inside release-staging.yml; both meant release.yml. My copy-paste artifact.
• Blanket contents: write on the staging workflow narrowed to the two jobs that tag and publish. plan reads history; build compiles and uploads artifacts - neither needs write.
• Version bound through env rather than interpolated into run: shells. It traces back to commit messages via semantic-release's output, which is the template-injection shape.

Not taken, with reasons

• Pinning dtolnay/rust-toolchain@master to a SHA. It is used in all seven places across every workflow in the repo. Pinning one file would be inconsistent rather than safer. Worth doing repo-wide, in its own change - the review framed this as an existing repo policy, but nothing in .github/workflows/ is pinned today.
• Loosening the placeholder heuristic. value_is_set rejects anything containing your-, _your_ or -here, which can in principle reject a valid Jira URL. But the failing examples are contrived, and tightening the rule is a product judgement about what a real credential looks like - not something to decide inside a review-fix PR. Worth its own issue if a user ever hits it.

Verified

• [x] cargo clippy --all-targets -- -D warnings clean
• [x] 16 integrations tests pass (15 before)
• [x] New test fails without the fix, passes with it
• [x] Workflow YAML parses; permissions are read at top, write on release + windows-release only

🤖 Generated with Claude Code

[Anonymous]

Originally posted by: coderabbitai[bot]

[!IMPORTANT]

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: a46655ab-1308-4bc5-9d2c-28c722d1ad32

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:
- [ ] 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

- [ ] Create PR with unit tests - [ ] Commit unit tests in branch `fix/review-followups-495`

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai) - [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai) - [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai) - [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)

_{Comment @coderabbitai help to get the list of available commands.}

[Anonymous]

Ticket changed by: Akarsh-Hegde

• status: open --> closed