Tests: github/webhooks.py has only 52% coverage — slash commands, PR handlers, and installation events untested

[BHUVANSH855]

Test Coverage Gap

Summary

app/github/webhooks.py has only 52% test coverage (114 of 239 statements
untested). The webhook dispatcher — the core routing layer of the entire bot —
has large untested sections.

Uncovered Sections

• Lines 62–77: timestamp skew check (webhook replay defense bot testing #2)
• Lines 93–136: push event config cache invalidation
• Lines 139–162: _handle_issues dispatch
• Lines 172–199: _handle_pull_request dispatch
• Lines 204–253: all slash commands (/assign, /unassign, /check-eligibility, /help, /label)
• Lines 258–290: _handle_label_command including the privilege escalation bypass (Issue /label command allows any issue author to apply arbitrary labels (privilege escalation) #85)
• Lines 339–395: installation repository add/remove events

Why This Matters

The slash command handlers (lines 204–253) are the primary user-facing
interface of the bot. The /label privilege escalation bug (Issue #85)
lives at line 269 and has no test — a test would have caught that the
issue author bypass was unintentional.

The installation repository handlers (lines 339–395) manage which repos
the bot operates on — bugs there could cause repos to be silently dropped
from tracking.

What Needs Tests

• Timestamp skew check rejects deliveries >300s old
• Push event invalidates config cache when hiero-bot.yml changes
• /assign, /unassign, /help, /check-eligibility slash commands
• /label — maintainer can add label
• /label — non-maintainer non-author is rejected
• /label — issue author bypass (document expected behavior after /label command allows any issue author to apply arbitrary labels (privilege escalation) #85 fix)
• installation_repositories added/removed events