fix: skip PVR for archived repos; treat PVR 422 as unknown

Signed-off-by: Mouad BANI <mouad-mb@outlook.com>

Author: mbani01

services/apps/packages_worker/src/security-contacts/extractors/http.ts

@@ -7,9 +7,11 @@ export function registryHeaders(userAgent: string): Record<string, string> {
   return { 'User-Agent': userAgent }
 }
 
-// Genuinely-absent → null body; every other non-200 throws so transient failures (429/5xx/...)
-// are treated as failures and the pipeline preserves existing data instead of wiping it.
-const ABSENT_STATUSES = new Set([404, 410])
+// Genuinely-absent / not-determinable → null body; every other non-200 throws so transient
+// failures (429/5xx/...) are treated as failures and the pipeline preserves data instead of
+// wiping it. 422 is included because GitHub's PVR endpoint returns it (per-repo, non-transient)
+// when the flag can't be determined — that must read as "unknown", not block the whole repo.
+const ABSENT_STATUSES = new Set([404, 410, 422])
 
 export interface FetchTextResult {
   status: number

services/apps/packages_worker/src/security-contacts/extractors/pvr.ts

@@ -34,6 +34,10 @@ export function mapPvr(
 }
 
 export const extractPvr: Extractor = async (target, deps) => {
+  // GitHub's PVR endpoint rejects archived (and private) repos with 422; skip the call for
+  // known-archived repos. Non-archived-yet-unknown repos still get the 422→unknown safety net.
+  if (target.archived) return { contacts: [], policies: {} }
+
   let owner: string
   let name: string
   try {

services/apps/packages_worker/src/security-contacts/processBatch.ts

@@ -58,6 +58,7 @@ interface SweepRow {
   id: string
   url: string
   homepage: string | null
+  archived: boolean | null
   packages: RepoPackage[] | null
 }
 
@@ -67,6 +68,7 @@ async function fetchBatch(qx: QueryExecutor): Promise<SweepRow[]> {
     SELECT r.id::text AS id,
            r.url,
            r.homepage,
+           r.archived,
            json_agg(json_build_object('purl', p.purl, 'ecosystem', p.ecosystem)) AS packages
     FROM repos r
     JOIN package_repos pr ON pr.repo_id = r.id
@@ -99,7 +101,13 @@ async function fetchBatch(qx: QueryExecutor): Promise<SweepRow[]> {
 }
 
 function toTarget(row: SweepRow): RepoTarget {
-  return { repoId: row.id, url: row.url, homepage: row.homepage, packages: row.packages ?? [] }
+  return {
+    repoId: row.id,
+    url: row.url,
+    homepage: row.homepage,
+    archived: row.archived,
+    packages: row.packages ?? [],
+  }
 }
 
 async function processRepo(

services/apps/packages_worker/src/security-contacts/types.ts

@@ -58,6 +58,8 @@ export interface RepoTarget {
   repoId: string
   url: string
   homepage: string | null
+  /** From the enricher; null = not yet enriched. Archived repos can't be queried for PVR. */
+  archived: boolean | null
   packages: RepoPackage[]
 }