feat: scope widget pipes by collection for Collections widget tabs

Adds segments_filtered_by_collection.pipe, the collection-scoped
counterpart to segments_filtered.pipe: resolves a collectionSlug to
every member project's insightsProjectId/segmentId/repositories via
insights_projects_populated_ds.collectionsSlugs, instead of a single
project's segment.

Updates the 7 leaf pipes that widgets in the Contributors, Popularity,
and Development tabs depend on to accept either project or
collectionSlug, switching their scalar '= (SELECT ... FROM
segments_filtered)' subquery to 'IN (SELECT ... FROM
segments_filtered_by_collection)' when scoped by collection:
activities_filtered, activities_filtered_retention,
activity_heatmap_by_weekday_and_2hours_blocks, pull_requests_filtered,
active_contributors (its own maintainers_count node), package_metrics,
packages, search_volume.

Every other widget pipe (leaderboards, dependency, retention,
geo-distribution, median times, review efficiency, merge lead time)
inherits collection scoping transparently through these 7, since they
already read from activities_filtered/pull_requests_filtered rather
than segments_filtered directly. segments_filtered itself and its
~25 other dependents (health scores, vulnerabilities, etc.) are left
untouched.

Signed-off-by: Gašper Grom <gasper.grom@gmail.com>

Author: gaspergrom

services/libs/tinybird/pipes/active_contributors.pipe

@@ -4,7 +4,8 @@ DESCRIPTION >
     - **When `granularity` is NOT provided, returns total unique contributor count** for the specified filters.
     - **When `granularity` is provided, returns time-series data** showing unique contributor counts for each time period.
     - Parameters:
-    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`
+    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `repos`: Optional array of repository URLs for filtering (inherited from `segments_filtered`)
     - `startDate`: Optional DateTime filter for activities after timestamp (e.g., '2024-01-01 00:00:00')
     - `endDate`: Optional DateTime filter for activities before timestamp (e.g., '2024-12-31 23:59:59')
@@ -55,7 +56,11 @@ SQL >
     SELECT uniqIf(memberId, memberId != '') AS maintainerCount
     FROM maintainers_roles_copy_ds
     WHERE
-        insightsProjectId = (SELECT insightsProjectId FROM segments_filtered) AND role = 'maintainer'
+        {% if defined(collectionSlug) %}
+            insightsProjectId IN (SELECT insightsProjectId FROM segments_filtered_by_collection)
+        {% else %} insightsProjectId = (SELECT insightsProjectId FROM segments_filtered)
+        {% end %}
+        AND role = 'maintainer'
         {% if defined(repos) %}
             AND repoUrl
             IN {{ Array(repos, 'String', description="Filter maintainer repo list", required=False) }}

services/libs/tinybird/pipes/activities_filtered.pipe

@@ -2,9 +2,12 @@ DESCRIPTION >
     - `activities_filtered.pipe` is the core filtering infrastructure pipe for activity data across the entire analytics platform.
     - This pipe serves as the foundation for most activity-related widgets, by providing a consistent, filtered view of contribution activities.
     - It filters activities from `activityRelations_deduplicated_cleaned_ds` datasource based on project segment, time ranges, repositories, platforms, and activity types.
-    - The pipe automatically scopes data to the current project using `segments_filtered` pipe for security and data isolation.
+    - The pipe scopes data either to a single project (via `segments_filtered`) or to every project in a collection
+    (via `segments_filtered_by_collection`), for security and data isolation. Exactly one of `project`/`collectionSlug`
+    must be provided by the caller.
     - Parameters:
-    - `project`: Inherited from `segments_filtered`, project slug (e.g., 'k8s', 'tensorflow')
+    - `project`: Project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `repos`: Optional array of repository URLs for filtering (e.g., ['https://github.com/kubernetes/kubernetes']). Inherited from `segments_filtered`.
     - `startDate`: Optional DateTime filter for activities after timestamp (e.g., '2024-01-01 00:00:00')
     - `endDate`: Optional DateTime filter for activities before timestamp (e.g., '2024-12-31 23:59:59')
@@ -23,7 +26,10 @@ SQL >
     SELECT activityId as id, timestamp, type, platform, memberId, organizationId, segmentId
     FROM activityRelations_bucket_routing a
     where
-        segmentId = (SELECT segmentId FROM segments_filtered)
+        {% if defined(collectionSlug) %}
+            segmentId IN (SELECT segmentId FROM segments_filtered_by_collection)
+        {% else %} segmentId = (SELECT segmentId FROM segments_filtered)
+        {% end %}
         {% if defined(startDate) %}
             AND a.timestamp
             > {{ DateTime(startDate, description="Filter activity timestamp after", required=False) }}

services/libs/tinybird/pipes/activities_filtered_retention.pipe

@@ -5,7 +5,8 @@ DESCRIPTION >
     - This time extension ensures retention rate calculations have the necessary baseline data from the preceding period for comparing distinct member activity for the first given period.
     - Primary use case: providing data foundation for member retention analysis and cohort studies.
     - Parameters:
-    - `project`: Inherited from `segments_filtered`, project slug (e.g., 'k8s', 'tensorflow')
+    - `project`: Inherited from `segments_filtered`, project slug (e.g., 'k8s', 'tensorflow'). Required unless `collectionSlug` is given.
+    - `collectionSlug`: Inherited from `segments_filtered_by_collection`, collection slug (e.g., 'cncf'). Required unless `project` is given.
     - `repos`: Inherited from `segments_filtered`, array of repository URLs for filtering
     - `startDate`: Optional DateTime filter, automatically extended backwards by one granularity period
     - `endDate`: Optional DateTime filter for activities before timestamp (e.g., '2024-12-31 23:59:59')
@@ -24,7 +25,10 @@ SQL >
     SELECT activityId as id, timestamp, type, platform, memberId, organizationId, segmentId
     FROM activityRelations_bucket_routing a
     where
-        segmentId = (SELECT segmentId FROM segments_filtered)
+        {% if defined(collectionSlug) %}
+            segmentId IN (SELECT segmentId FROM segments_filtered_by_collection)
+        {% else %} segmentId = (SELECT segmentId FROM segments_filtered)
+        {% end %}
         {% if defined(startDate) %}
             AND a.timestamp
             > {% if defined(granularity) and granularity == "daily" %}

services/libs/tinybird/pipes/activity_heatmap_by_weekday_and_2hours_blocks.pipe

@@ -5,7 +5,8 @@ DESCRIPTION >
     - Returns a complete grid of all weekday/time combinations with zero counts for periods with no activity, ensuring consistent heatmap visualization.
     - Primary use case: identifying contribution patterns outside traditional work hours for community health analysis.
     - Parameters:
-    - `project`: Inherited from `segments_filtered`, project slug (e.g., 'k8s', 'tensorflow')
+    - `project`: Inherited from `segments_filtered`, project slug (e.g., 'k8s', 'tensorflow'). Required unless `collectionSlug` is given.
+    - `collectionSlug`: Inherited from `segments_filtered_by_collection`, collection slug (e.g., 'cncf'). Required unless `project` is given.
     - `repos`: Inherited from `segments_filtered`, array of repository URLs for filtering
     - `startDate`: Optional DateTime filter for activities after timestamp (e.g., '2024-01-01 00:00:00')
     - `endDate`: Optional DateTime filter for activities before timestamp (e.g., '2024-12-31 23:59:59')
@@ -18,7 +19,10 @@ SQL >
     select count(id) as activityCount, weekday, two_hours_block
     from contributions_with_local_time_ds a
     where
-        segmentId = (SELECT segmentId FROM segments_filtered)
+        {% if defined(collectionSlug) %}
+            segmentId IN (SELECT segmentId FROM segments_filtered_by_collection)
+        {% else %} segmentId = (SELECT segmentId FROM segments_filtered)
+        {% end %}
         {% if defined(startDate) %}
             AND a.timestamp
             > {{ DateTime(startDate, description="Filter activity timestamp after", required=False) }}

services/libs/tinybird/pipes/package_metrics.pipe

@@ -6,7 +6,8 @@ DESCRIPTION >
     - Uses custom time-series generation logic specifically designed for package download data patterns.
     - Primary use case: powers package downloads and package dependency widgets.
     - Parameters:
-    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`
+    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `startDate`: Optional DateTime filter for package data after timestamp (e.g., '2024-01-01 00:00:00')
     - `endDate`: Optional DateTime filter for package data before timestamp (e.g., '2024-12-31 23:59:59')
     - `ecosystem`: Optional string to filter by package ecosystem (e.g., 'npm', 'pypi', 'maven')
@@ -23,7 +24,10 @@ SQL >
     SELECT *
     FROM packageDownloads p FINAL
     where
-        insightsProjectId = (select insightsProjectId from segments_filtered)
+        {% if defined(collectionSlug) %}
+            insightsProjectId IN (select insightsProjectId from segments_filtered_by_collection)
+        {% else %} insightsProjectId = (select insightsProjectId from segments_filtered)
+        {% end %}
         {% if defined(startDate) %}
             AND p.date > toDate(
                 {{ DateTime(startDate, description="Filter package downloads after", required=False) }}

services/libs/tinybird/pipes/packages.pipe

@@ -5,7 +5,8 @@ DESCRIPTION >
     - Uses `segments_filtered` for automatic project scoping and optional repository filtering.
     - Primary use case: powers package selection dropdown in the package downloads widget.
     - Parameters:
-    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`
+    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `search`: Optional string for searching package names or ecosystems (case-insensitive with wildcards)
     - `repos`: Optional array of repository URLs to filter packages by specific repositories (e.g., ['https://github.com/kubernetes/kubernetes'])
     - Response: `repo`, `name`, `ecosystem` (distinct packages matching the filters)
@@ -16,7 +17,10 @@ SQL >
     SELECT distinct p.repo, p.name, p.ecosystem
     FROM packageDownloads p
     where
-        p.insightsProjectId = (select insightsProjectId from segments_filtered)
+        {% if defined(collectionSlug) %}
+            p.insightsProjectId IN (select insightsProjectId from segments_filtered_by_collection)
+        {% else %} p.insightsProjectId = (select insightsProjectId from segments_filtered)
+        {% end %}
         {% if defined(search) %}
             AND (
                 p.name

services/libs/tinybird/pipes/pull_requests_filtered.pipe

@@ -2,18 +2,25 @@ DESCRIPTION >
     - `pull_requests_filtered.pipe` is the core filtering infrastructure for pull request analytics across the platform.
     - Provides consistent, reusable PR filtering logic for all pull request-related widgets and analytics.
     - Uses `pull_requests_analyzed` datasource which contains pre-calculated PR metrics and timing data.
-    - Automatically scopes data to the current project using `segments_filtered` pipe for security and data isolation.
+    - Scopes data either to a single project (via `segments_filtered`) or to every project in a collection (via
+    `segments_filtered_by_collection`), for security and data isolation. Exactly one of `project`/`collectionSlug`
+    must be provided by the caller.
     - Supports repository-level filtering for targeted PR analysis within projects.
     - Primary use case: serving as the foundation for all PR analytics pipes including lead times, review metrics, and velocity analysis.
     - Parameters:
-    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`
+    - `project`: Project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `repos`: Optional array of repository URLs for filtering PRs by specific repositories (e.g., ['https://github.com/kubernetes/kubernetes'])
     - Response: All fields from `pull_requests_analyzed` including PR metadata, timing metrics, and calculated fields
 
 NODE pull_requests_filtered_0
 SQL >
+    %
     SELECT *
     FROM pull_requests_analyzed pra
     WHERE
-        pra.segmentId = (SELECT segmentId FROM segments_filtered)
+        {% if defined(collectionSlug) %}
+            pra.segmentId IN (SELECT segmentId FROM segments_filtered_by_collection)
+        {% else %} pra.segmentId = (SELECT segmentId FROM segments_filtered)
+        {% end %}
         AND pra.channel IN (SELECT channel FROM repos_to_channels)

services/libs/tinybird/pipes/search_volume.pipe

@@ -5,7 +5,8 @@ DESCRIPTION >
     - Formats timestamps for consistent date representation in visualizations.
     - Primary use case: displaying search trend analytics and project popularity metrics in dashboard widgets.
     - Parameters:
-    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`
+    - `project`: Required string for project slug (e.g., 'k8s', 'tensorflow') - inherited from `segments_filtered`. Required unless `collectionSlug` is given.
+    - `collectionSlug`: Collection slug (e.g., 'cncf') - inherited from `segments_filtered_by_collection`. Required unless `project` is given.
     - `startDate`: Optional DateTime filter for search volume data after timestamp (e.g., '2024-01-01 00:00:00')
     - `endDate`: Optional DateTime filter for search volume data before timestamp (e.g., '2024-12-31 23:59:59')
     - Response: `insightsProjectId`, `project`, `dataTimestamp` (formatted as YYYY-MM-DD), `volume`, `updatedAt`
@@ -21,7 +22,11 @@ SQL >
         updatedAt
     FROM searchVolume FINAL
     WHERE
-        insightsProjectId = toUUID((select insightsProjectId from segments_filtered))
+        {% if defined(collectionSlug) %}
+            insightsProjectId
+            IN (select toUUID(insightsProjectId) from segments_filtered_by_collection)
+        {% else %} insightsProjectId = toUUID((select insightsProjectId from segments_filtered))
+        {% end %}
         {% if defined(startDate) %}
             AND searchVolume.dataTimestamp >= parseDateTimeBestEffort(
                 {{

services/libs/tinybird/pipes/segments_filtered_by_collection.pipe

@@ -0,0 +1,35 @@
+DESCRIPTION >
+    - `segments_filtered_by_collection.pipe` is the collection-scoped counterpart to `segments_filtered.pipe`:
+    it establishes project scope for the widget pipes that back the Collection detail page's Contributors,
+    Popularity, and Development tabs, resolving a collection to every one of its member projects instead of
+    a single project.
+    - **Requires `collectionSlug` parameter** - without it, returns no results (WHERE clause becomes AND false).
+    - Returns one row per project in the collection (not a single aggregate row) - `insights_projects_populated_ds.collectionsSlugs`
+    already lists every collection each project belongs to (see `insightsProjects_filtered.pipe` and
+    `collection_insights_aggregate.pipe` for the same `has(collectionsSlugs, ...)` filter pattern), so this
+    pipe resolves collection membership directly rather than requiring the caller to first look up a project
+    id list.
+    - Downstream pipes that today do `segmentId = (SELECT segmentId FROM segments_filtered)` (a single-value
+    scalar subquery) must switch to `segmentId IN (SELECT segmentId FROM segments_filtered_by_collection)`
+    when scoping by collection instead of by project, since this pipe can return multiple rows.
+    - Ensures only enabled projects are accessible.
+    - Parameters:
+    - `collectionSlug`: Required string for collection slug (e.g., 'cncf', 'agentic-ai-foundation')
+    - Response: `insightsProjectId`, `segmentId`, `repositories` (array of the project's own repositories) - one row per project in the collection
+
+TAGS "Infrastructure", "Core", "Project scoping", "Security", "Collection"
+
+NODE segments_filtered_by_collection_0
+SQL >
+    %
+    SELECT id as insightsProjectId, segmentId, repositories
+    FROM insights_projects_populated_ds
+    WHERE
+        enabled = 1
+        {% if defined(collectionSlug) %}
+            AND has(
+                collectionsSlugs,
+                {{ String(collectionSlug, description="Filter by collection slug", required=True) }}
+            )
+        {% else %} AND false
+        {% end %}