Fix: config cache corruption when filtering workflows by source repo

The loadAndMatchWorkflows function was mutating the cached YAMLConfig
by replacing its Workflows slice with only the matching workflows.
This caused subsequent webhook handlers for different source repos
to see an incomplete config (only workflows from the first request).

Fix: Create a shallow copy of the config before modifying the Workflows
slice, preserving the cached original for future requests.

Author: cbullinger

services/webhook_handler_new.go

@@ -550,8 +550,10 @@ func loadAndMatchWorkflows(ctx context.Context, config *configs.Config, containe
 		"matching_count": len(matching),
 	})
 
-	yamlConfig.Workflows = matching
-	return yamlConfig, nil
+	// Return a shallow copy with only matching workflows to avoid mutating the cached config
+	filteredConfig := *yamlConfig
+	filteredConfig.Workflows = matching
+	return &filteredConfig, nil
 }
 
 // fetchChangedFiles retrieves the files changed in a PR, logging and notifying on error.