fix[backend](integrations): fixed plugins yaml files integration form…

[AlexSanchez-bit]

No description provided.

[github-actions]

🛑 AI review — Sensitive area, extra care recommended

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. Review carefully before merging.

⚠️ architecture (gemini-3-flash-lite) — minor findings

Summary: Introduced file-based locking for tenant storage; logic is sound but relies on platform-specific syscalls in a core repository module.

• medium backend/modules/integrations/repository/tenant_store.go:13 — Use of syscall.Flock is platform-specific. While the comment notes Linux/BSD, consider abstracting this into a internal/fsutil or similar package to keep repository logic clean and testable across environments.
• medium backend/modules/integrations/repository/tenant_store.go:105 — The Load method now returns an empty slice instead of an error when a plugin key is missing. Ensure this change in behavior does not break existing callers expecting an error if the file structure is invalid.

🛑 bugs (gemini-3-flash-lite) — high/critical — please review

Summary: Potential data loss in Load/Save cycle due to file truncation and race conditions in file locking.

• high backend/modules/integrations/repository/tenant_store.go:128 — The saveLocked function uses os.Create (implied by os.OpenFile default behavior if not specified, or if the file is overwritten) without truncating or using a temporary file. If yaml.Marshal fails or the write is interrupted, the existing tenant file will be corrupted or emptied. Use os.WriteFile or a temp-file-and-rename pattern.
• high backend/modules/integrations/repository/tenant_store.go:23 — The withFileLock function opens the lock file with os.O_CREATE|os.O_RDWR but does not truncate it. While this is fine for a lock file, the implementation of saveLocked (line 128) does not specify O_TRUNC, meaning if the new YAML content is shorter than the old one, the file will contain trailing garbage data, causing subsequent yaml.Unmarshal calls to fail.

🛑 security (gemini-3-flash-lite) — high/critical — please review

Summary: Introduces file-based locking mechanism for tenant storage, touching security-critical persistence paths.

• medium backend/modules/integrations/repository/tenant_store.go:23 — The withFileLock function uses 0o600 permissions for lock files. While this restricts access to the owner, ensure that the application process runs with the least privilege necessary, as these lock files are created in the same directory as sensitive tenant configuration files.

🟢 go-deps — up to date

No pending Go dependency updates.

[AlexSanchez-bit]

this is not a highly concurrent usage, no need to overcomplicate writing process