fix: make installation repository events idempotent

[AbhishekMauryaGEEK]

Summary

Makes installation_repositories.added webhook processing idempotent by replacing insert() with upsert().

Related Issue

Closes #262

Type of Change

• Bug fix
• Reliability improvement

What Changed?

• Replaced insert() with upsert() when handling repositories_added events.
• Added conflict handling on (installation_id, repo_full_name).
• Added a regression test covering repositories_added webhook processing.

Why?

GitHub may redeliver webhook events. The installation_repositories table uses a composite primary key:

(installation_id, repo_full_name)

Using insert() could cause duplicate-key failures if the same webhook is replayed or redelivered.

Switching to upsert() makes the operation idempotent and aligns this code path with the existing installation creation flow, which already uses upsert() for repository synchronization.

Validation

• npm run typecheck ✅
• npm test ✅

Checklist

• My code follows the project structure and conventions
• I tested the changes locally
• Added a regression test for the modified behavior
• No breaking changes introduced

[vercel]

@AbhishekMauryaGEEK is attempting to deploy a commit to the codersogs-3057's projects Team on Vercel.

A member of the Team first needs to authorize it.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
mergeship	Ready	Preview, Comment	Jun 6, 2026 9:47am

[jakharmonika364]

LGTM! Excellent improvements to security, concurrency guards, and webhook replay idempotency.