fix: don't defer packagist refresh on p2-only failure

Signed-off-by: anilb <epipav@gmail.com>

Author: epipav

services/apps/packages_worker/src/packagist/__tests__/ingest.test.ts

@@ -197,10 +197,14 @@ describe('ingestOnePackagistMetadata', () => {
     await p
 
     expect(mockPersistMetadata).not.toHaveBeenCalled()
+    // p2-only failure must not bump metadata_last_run_at — phase 1 already succeeded,
+    // but versions/deps never refreshed, so the package must stay due
     expect(mockMarkMetadata).toHaveBeenCalledWith(
       qx,
       PURL,
       expect.objectContaining({ status: 'error', errorKind: 'NOT_FOUND' }),
+      undefined,
+      false,
     )
   })
 
@@ -224,6 +228,8 @@ describe('ingestOnePackagistMetadata', () => {
       qx,
       PURL,
       expect.objectContaining({ status: 'error', errorKind: 'NOT_FOUND' }),
+      undefined,
+      false,
     )
   })
 

services/apps/packages_worker/src/packagist/activities.ts

@@ -151,7 +151,16 @@ export async function ingestOnePackagistMetadata(
       { purl: candidate.purl, statusCode: p2.error.statusCode, kind: p2.error.kind },
       'packagist metadata 4xx/malformed after fast retries — marking scanned and skipping',
     )
-    await markPackagistMetadataScanned(qx, candidate.purl, giveUpResult(p2.error, p2.attempts))
+    // Phase 1 already succeeded — only p2 (versions/deps) failed to refresh. Don't push
+    // metadata_last_run_at forward, or due-selection wrongly treats this package as
+    // "recently scanned" and skips it for the full refresh window despite stale p2 data.
+    await markPackagistMetadataScanned(
+      qx,
+      candidate.purl,
+      giveUpResult(p2.error, p2.attempts),
+      undefined,
+      false,
+    )
     return
   }
 

services/libs/data-access-layer/src/packages/packagistPackageState.ts

@@ -26,15 +26,25 @@ export async function markPackagistMetadataScanned(
   purl: string,
   result: PackagistRunResult,
   metadataLastModified?: string | null,
+  // p2-only failures (phase 1 already succeeded) should NOT push the refresh watermark
+  // forward — versions/dependencies never actually refreshed, so the package must stay
+  // (or become) due again on the next run instead of sitting out the full refresh window.
+  bumpLastRunAt = true,
 ): Promise<void> {
   await qx.result(
     `INSERT INTO packagist_package_state (purl, metadata_run_result, metadata_last_run_at, metadata_last_modified)
-     VALUES ($(purl), $(result)::jsonb, NOW(), $(metadataLastModified))
+     VALUES ($(purl), $(result)::jsonb, CASE WHEN $(bumpLastRunAt) THEN NOW() ELSE NULL END, $(metadataLastModified))
      ON CONFLICT (purl) DO UPDATE SET
        metadata_run_result    = EXCLUDED.metadata_run_result,
-       metadata_last_run_at   = EXCLUDED.metadata_last_run_at,
+       metadata_last_run_at   = CASE WHEN $(bumpLastRunAt) THEN EXCLUDED.metadata_last_run_at
+                                      ELSE packagist_package_state.metadata_last_run_at END,
        metadata_last_modified = COALESCE(EXCLUDED.metadata_last_modified, packagist_package_state.metadata_last_modified)`,
-    { purl, result: JSON.stringify(result), metadataLastModified: metadataLastModified ?? null },
+    {
+      purl,
+      result: JSON.stringify(result),
+      metadataLastModified: metadataLastModified ?? null,
+      bumpLastRunAt,
+    },
   )
 }