Fix EasyCLA new backend outage

[lukaszgryglicki]

Fixes prod outage (which is already reverted, but we want to retry porting py->go).

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 0949bcb0-90d6-4385-abaf-cb3469f1c87b

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch unicron-fix-easycla-outage

Tip

💬 Introducing Slack Agent: The best way for teams to turn conversations into code.

Slack Agent is built on CodeRabbit's deep understanding of your code, so your team can collaborate across the entire SDLC without losing context.

• Generate code and open pull requests
• Plan features and break down work
• Investigate incidents and troubleshoot customer tickets together
• Automate recurring tasks and respond to alerts with triggers
• Summarize progress and report instantly

Built for teams:

• Shared memory across your entire org—no repeating context
• Per-thread sandboxes to safely plan and execute work
• Governance built-in—scoped access, auditability, and budget controls

One agent for your entire SDLC. Right inside Slack.

👉 Get started

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[Copilot]

Pull request overview

This PR addresses a production outage/regression during the Python→Go port by (1) preventing DynamoDB type coercion bugs caused by InterfaceMapToItem’s numeric-string heuristic and (2) fixing GitHub org-based approval checks to use a permissions-safe endpoint that matches the legacy Python behavior.

Changes:

• Avoid InterfaceMapToItem round-trips for project create/update by constructing and patching DynamoDB AttributeValue maps directly.
• Avoid InterfaceMapToItem round-trips in the legacy GitHub OAuth “get-or-create user” path; preserve the pre-cutover JSON wire shape for user_github_id.
• Fix CCLA org-approval logic to check a user’s public org memberships via GET /users/<user>/orgs instead of an endpoint that commonly returns 403 for customer orgs.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

File	Description
cla-backend-legacy/internal/api/handlers.go	Builds/patches DynamoDB items directly for project create/update to prevent numeric-string coercion of string fields.
cla-backend-legacy/internal/api/github_oauth.go	Updates user create/update to operate on raw DynamoDB AttributeValue maps and preserves legacy user_github_id response type.
cla-backend-go/signatures/service.go	Fixes org approval checks to use public org listing, preventing false negatives caused by 403s on membership endpoints.
cla-backend-go/github/github_org.go	Adds ListUserPublicOrgs helper to list a user’s publicly visible org memberships using the legacy-compatible endpoint.

[mlehotskylf]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.