fix: resolve GitHub handles from noreply emails, fix bot false positives

Signed-off-by: Mouad BANI <mouad-mb@outlook.com>

Author: mbani01

services/apps/packages_worker/src/security-contacts/processBatch.ts

@@ -16,7 +16,7 @@ import { extractSecurityMd } from './extractors/securityMd'
 import { extractSecurityTxt } from './extractors/securityTxt'
 import { githubApiGet } from './githubToken'
 import { reconcile } from './reconcile'
-import { resolveCdpEmails } from './resolveCdpEmails'
+import { deriveGithubHandlesFromNoreplyEmails, resolveCdpEmails } from './resolveCdpEmails'
 import {
   Extractor,
   ExtractorDeps,
@@ -162,6 +162,8 @@ export async function processRepo(
     contacts = contacts.filter((c) => c.channel !== 'github-pvr')
   }
 
+  contacts.push(...deriveGithubHandlesFromNoreplyEmails(contacts))
+
   const handleContacts = contacts.filter((c) => c.channel === 'github-handle')
   if (handleContacts.length > 0) {
     try {

services/apps/packages_worker/src/security-contacts/resolveCdpEmails.ts

@@ -1,3 +1,4 @@
+import { parseGitHubNoreplyEmail } from '@crowd/common'
 import {
   findMembersByGithubHandles,
   findResolvableEmailsForMembers,
@@ -13,6 +14,28 @@ function latestTimestamp(provenance: ProvenanceEntry[]): string {
     : times.reduce((a, b) => (new Date(b).getTime() > new Date(a).getTime() ? b : a))
 }
 
+// A GitHub noreply email already encodes its owner's handle — derive it so the handle can be
+// resolved to a real address the same way any other github-handle contact is. The noreply email
+// itself is kept as the provenance source, so the resolved contact's origin stays traceable.
+export function deriveGithubHandlesFromNoreplyEmails(contacts: RawContact[]): RawContact[] {
+  const derived: RawContact[] = []
+  for (const c of contacts) {
+    if (c.channel !== 'email') continue
+    const handle = parseGitHubNoreplyEmail(c.value)
+    if (!handle) continue
+    derived.push({
+      channel: 'github-handle',
+      value: handle,
+      role: c.role,
+      tier: c.tier,
+      provenance: [
+        { source: c.value, sourceTier: c.tier, fetchedAt: latestTimestamp(c.provenance) },
+      ],
+    })
+  }
+  return derived
+}
+
 export async function resolveCdpEmails(
   cdpQx: QueryExecutor,
   handleContacts: RawContact[],
@@ -51,8 +74,9 @@ export async function resolveCdpEmails(
         channel: 'email' as const,
         value: email,
         role: contact.role,
+        handle: contact.value,
         tier: contact.tier,
-        provenance: [{ source, sourceTier: contact.tier, fetchedAt }],
+        provenance: [...contact.provenance, { source, sourceTier: contact.tier, fetchedAt }],
       }))
     })
   })

services/libs/common/src/constants/bots.ts

@@ -79,3 +79,54 @@ export const knownBots = new Set([
   'totesmessenger',
   'vredditdownloader',
 ])
+
+/**
+ * Subset of knownBots safe for matching against email local-parts — excludes community
+ * chat-bot usernames (Discord/Reddit) that collide with real personal names (e.g. craig, maki).
+ */
+export const emailSafeKnownBots = new Set([
+  'allcontributors',
+  'better-code-hub',
+  'bors',
+  'bors-servo',
+  'brewtestbot',
+  'codeclimate',
+  'codepilot',
+  'coderabbit',
+  'copilot',
+  'dependabot',
+  'easycla',
+  'fabbot',
+  'facebook-github-bot',
+  'github-merge-queue',
+  'goreleaserbot',
+  'harness-ci',
+  'hashibot',
+  'homebrewbumpbot',
+  'homu',
+  'jenkins',
+  'mergify',
+  'msftbot',
+  'opentelemetrybot',
+  'pep8speaks',
+  'prombot',
+  'pullrequest',
+  'renovate',
+  'reviewdog',
+  'rust-highfive',
+  'rustbot',
+  'scala-steward',
+  'scrutinizer-auto-fixer',
+  'sonatype-lift',
+  'sphinx-bot',
+  'teamcity',
+  'tensorflower',
+  'web-flow',
+  'weblate',
+  'zuul',
+  'codecov',
+  'deepsource',
+  'gitguardian',
+  'snyk',
+  'whitesource',
+])

services/libs/common/src/email.ts

@@ -1,7 +1,6 @@
 import validator from 'validator'
 
-import { isKnownBot } from './bot'
-import { disposableEmailDomains, noreplyEmailProviders } from './constants'
+import { disposableEmailDomains, emailSafeKnownBots, noreplyEmailProviders } from './constants'
 
 export const isValidEmail = (value: string): boolean => {
   return validator.isEmail(value)
@@ -118,7 +117,7 @@ const emailDomain = (value: string): string => value.slice(value.indexOf('@') +
 const looksLikeBot = (localPart: string): boolean => {
   const lp = localPart.toLowerCase()
   if (ROLE_LOCAL_PARTS.has(lp)) return false
-  if (isKnownBot(lp)) return true
+  if (emailSafeKnownBots.has(lp)) return true
   if (lp.endsWith('[bot]')) return true
   if (BOT_EXACT_LOCAL_PARTS.has(lp)) return true
   // 'bot' as a delimited token: bot-*, *-bot, *.bot, bot_* ...
@@ -151,7 +150,7 @@ export const classifyEmailReachability = (email: string): EmailReachability => {
   const localPart = getEmailLocalPart(value)
   const baseLocalPart = localPart.split('+')[0]
   if (NOREPLY_LOCAL_PARTS.has(baseLocalPart)) return fail('noreply')
-  if (looksLikeBot(localPart)) return fail('bot')
+  if (looksLikeBot(baseLocalPart)) return fail('bot')
   if (disposableEmailDomains.has(emailDomain(value))) return fail('disposable')
 
   return { email, reachable: true, reason: null }