fix: Filter junk from GitHub attachment import, and turn it on by default

[Zach Dunn (zachdunn)]

Why

Bots (e.g. claude[bot] on buildinternet/sunny#1173) embed small decorative GIFs, badges, and status images in PR/issue comments, and the attachment importer was mirroring them into workspaces as junk. Separately, importing required flipping a knob, so most linked repos never got the feature.

What

Junk filters in the ingest reconcile core (apps/api/src/github-ingest.ts):

• Attachments in a body/comment authored by a *[bot] login are a permanent bot_author skip — never fetched, never ledgered. Applies to the webhook path and manual uploads ingest alike.
• Images under 200px on either side are a permanent too_small skip, using a new detectImageDimensions helper in guards.ts that reads PNG/GIF/JPEG/WebP dimensions straight from the header. Undecodable headers fail open (index tier; originals stay on GitHub).

New knob: ingestBotAttachments: true in .uploads.yml (or as a workspace default) re-admits bot media on the webhook path. Added to the canonical @uploads/comment-config, the CLI's generated copy, and the golden parity fixture.

Default flip: ingestGithubAttachments now defaults to on in AUTO_COMMENT_OPTIONS. Workspaces or repos that explicitly set it off keep their setting; the settings toggle now paints unset as on.

Docs: new "Imported attachments" section on /docs/github-app, both knobs documented in /docs/comment-config (its "presentation only" framing corrected), uploads ingest help text and docs/cli.md updated.

Notes

• The default flip affects every workspace that never explicitly saved the toggle, not only new ones — workspaces that ever saved the comment-settings form stored an explicit value and are unaffected.
• The dimension gate is dimension-based rather than byte-based on purpose: the junk class (emoji, badges, tracking pixels) is defined by pixel size, and a byte floor would false-positive on simple legitimate screenshots.

Testing

• TDD throughout; full suite: 299 files / 4408 tests green, typecheck and lint clean.
• Docs pages verified rendering in the browser.

[changeset-bot]

🦋 Changeset detected

Latest commit: c529b74

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@buildinternet/uploads	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (2)

• coderabbit:review
• review

🚫 Excluded labels (none allowed) (1)

• wip

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 2450b131-48f2-4cb6-aad5-a54df07c654f

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}