fix(selfhost): use ORB_WEBHOOK_SECRET/ORB_APP_ID in Orb collector + drop AUTOINCREMENT from Orb migrations

Use the Orb-specific env vars (ORB_WEBHOOK_SECRET, ORB_APP_ID) in exportOrbBatch and instanceId()
instead of the main app's GITHUB_WEBHOOK_SECRET/GITHUB_APP_ID — prevents empty-string HMAC signing
when only the Orb secret is set. Drop AUTOINCREMENT from orb_events/orb_installations DDL so the
Postgres migration adapter accepts both tables (it translates INTEGER PRIMARY KEY but not AUTOINCREMENT).

Author: JSONbored

migrations/0056_orb_events.sql

@@ -3,7 +3,7 @@
 -- export job to batch-send calibration signals to the central collector (opt-in) or
 -- to keep them local for operator-only analysis (ORB_AIR_GAP=true).
 CREATE TABLE IF NOT EXISTS orb_events (
-  id          INTEGER PRIMARY KEY AUTOINCREMENT,
+  id          INTEGER PRIMARY KEY,
   repo        TEXT    NOT NULL,
   pr_number   INTEGER NOT NULL,
   head_sha    TEXT    NOT NULL,

migrations/0057_orb_installations.sql

@@ -1,7 +1,7 @@
 -- Gittensory Orb (#1219): tracks which repos have the Orb GitHub App installed.
 -- `removed_at IS NULL` = currently installed; set on uninstall/removal events.
 CREATE TABLE IF NOT EXISTS orb_installations (
-  id              INTEGER PRIMARY KEY AUTOINCREMENT,
+  id              INTEGER PRIMARY KEY,
   installation_id INTEGER NOT NULL,
   repo            TEXT    NOT NULL,
   installed_at    TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%SZ', 'now')),

src/selfhost/orb-collector.ts

@@ -46,9 +46,9 @@ interface OrbExportPayload {
   }>;
 }
 
-/** Stable instance identifier (hash of the App ID — no PII). */
+/** Stable instance identifier (hash of the Orb App ID — no PII). */
 function instanceId(): string {
-  return createHash("sha256").update(process.env.GITHUB_APP_ID ?? "unknown").digest("hex").slice(0, 16);
+  return createHash("sha256").update(process.env.ORB_APP_ID ?? "unknown").digest("hex").slice(0, 16);
 }
 
 /** HMAC a string with the webhook secret for anonymized export. */
@@ -93,7 +93,7 @@ export async function exportOrbBatch(
   if ((process.env.ORB_AIR_GAP ?? "").toLowerCase() === "true") return 0;
 
   const collectorUrl = process.env.ORB_COLLECTOR_URL ?? "https://orb.gittensory.app/v1/ingest";
-  const secret = process.env.GITHUB_WEBHOOK_SECRET ?? "";
+  const secret = process.env.ORB_WEBHOOK_SECRET ?? "";
   const anonymize = (process.env.ORB_ANONYMIZE ?? "true").toLowerCase() !== "false";
 
   const { results } = await db

test/unit/selfhost-orb-collector.test.ts

@@ -116,14 +116,14 @@ describe("exportOrbBatch()", () => {
   beforeEach(() => {
     resetMetrics();
     process.env.ORB_ENABLED = "true";
-    process.env.GITHUB_WEBHOOK_SECRET = "test-secret";
+    process.env.ORB_WEBHOOK_SECRET = "test-secret";
     process.env.ORB_ANONYMIZE = "true";
     delete process.env.ORB_AIR_GAP;
     delete process.env.ORB_COLLECTOR_URL;
   });
   afterEach(() => {
     delete process.env.ORB_ENABLED;
-    process.env.GITHUB_WEBHOOK_SECRET = undefined as unknown as string;
+    process.env.ORB_WEBHOOK_SECRET = undefined as unknown as string;
     delete process.env.ORB_ANONYMIZE;
     delete process.env.ORB_AIR_GAP;
     delete process.env.ORB_COLLECTOR_URL;
@@ -228,8 +228,8 @@ describe("exportOrbBatch()", () => {
     expect(sigHeader).toMatch(/^sha256=[a-f0-9]{64}$/);
   });
 
-  it("uses empty-string HMAC key when GITHUB_WEBHOOK_SECRET is unset (covers ?? '' branch)", async () => {
-    delete (process.env as NodeJS.Dict<string>)["GITHUB_WEBHOOK_SECRET"];
+  it("uses empty-string HMAC key when ORB_WEBHOOK_SECRET is unset (covers ?? '' branch)", async () => {
+    delete (process.env as NodeJS.Dict<string>)["ORB_WEBHOOK_SECRET"];
     const db = makeDb();
     await recordOrbEvent(db, { repo: "o/r", pr_number: 1, head_sha: "sha", outcome: "merged" });
     let sigHeader: string | undefined;