fix: comments

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

backend/src/api/public/v1/akrites-external/openapi.yaml

@@ -458,8 +458,9 @@ components:
       type: object
       required: [results]
       description: >
-        Plain array in request order, one entry per submitted job — unlike the
-        read batches there is no found/not-found case, every job is submitted.
+        Plain array in request order, one entry per requested job — unlike the
+        read batches there is no found/not-found case, but a job can still come
+        back with status: failed if row creation or the workflow start failed.
       properties:
         results:
           type: array

backend/src/api/public/v1/packages/submitBlastRadiusJobBatch.ts

@@ -3,7 +3,6 @@ import type { Request, Response } from 'express'
 import { generateUUIDv4 } from '@crowd/common'
 import * as blastRadiusDal from '@crowd/data-access-layer/src/packages/blastRadius'
 import { QueryExecutor } from '@crowd/data-access-layer/src/queryExecutor'
-import { Client } from '@crowd/temporal'
 import { ITriggerBlastRadiusAnalysis, TemporalWorkflowId } from '@crowd/types'
 
 import { getPackagesQx } from '@/db/packagesDb'
@@ -32,18 +31,16 @@ export async function submitBlastRadiusJobBatch(req: Request, res: Response): Pr
   const { jobs } = validateOrThrow(blastRadiusJobBatchRequestSchema, req.body)
 
   const qx = await getPackagesQx()
-  const packagesTemporal = await getPackagesTemporalClient()
 
   const results: BlastRadiusJobEntry[] = await Promise.all(
-    jobs.map((body) => submitOneJob(qx, packagesTemporal, body)),
+    jobs.map((body) => submitOneJob(qx, body)),
   )
 
   res.status(202).json({ results })
 }
 
 async function submitOneJob(
   qx: QueryExecutor,
-  packagesTemporal: Client,
   body: BlastRadiusJobRequest,
 ): Promise<BlastRadiusJobEntry> {
   const jobPackage = body.package ?? null
@@ -64,6 +61,12 @@ async function submitOneJob(
     // must not reject the whole batch's Promise.all, only this job's entry.
     await blastRadiusDal.createAnalysis(qx, analysisInput)
 
+    // Acquired per job (inside the try), not once up front — getPackagesTemporalClient
+    // caches its connection in a module-level singleton, so this is cheap once
+    // connected, but a first-ever connection failure must fail this job's entry only,
+    // not reject the whole batch before any per-job try/catch is in play.
+    const packagesTemporal = await getPackagesTemporalClient()
+
     await packagesTemporal.workflow.start('analyzeBlastRadius', {
       taskQueue: 'blast-radius-worker',
       workflowId: `${TemporalWorkflowId.BLAST_RADIUS_ANALYSIS}/${analysisId}`,

services/apps/packages_worker/src/blast-radius/dependentsScan.ts

@@ -13,7 +13,11 @@ import { rangeIncludesAny } from './semverRange'
 
 // Configurable via env var so local load tests can vary it per run without
 // editing source; unset in every real deployment, so this is always 32 in prod.
-const SCAN_CONCURRENCY = Number(process.env.BLAST_RADIUS_SCAN_CONCURRENCY) || 32
+// Clamped to a positive integer — a negative or fractional override would make
+// forEachWithConcurrency's Array.from({length: concurrency}) spin up zero workers,
+// so the scan would silently complete with nothing processed.
+const SCAN_CONCURRENCY =
+  Math.max(1, Math.floor(Number(process.env.BLAST_RADIUS_SCAN_CONCURRENCY))) || 32
 const HIGH_IMPACT_CACHE_TTL_MS = 24 * 60 * 60 * 1000
 // The per-candidate fetches below (abbreviated packument, full packument, download count)
 // don't depend on which target package the analysis is checking against — the same

services/apps/packages_worker/src/blast-radius/stages/reachability.ts

@@ -21,8 +21,11 @@ const mkdtemp = promisify(fs.mkdtemp)
 const MAX_ATTEMPTS = 3
 const RETRY_BACKOFF_BASE = 15_000 // 15 seconds
 // Tunable for load testing, same pattern as BLAST_RADIUS_SCAN_CONCURRENCY for phase 1/2 —
-// default matches the previous hardcoded value.
-const REACHABILITY_CONCURRENCY = Number(process.env.BLAST_RADIUS_REACHABILITY_CONCURRENCY) || 4
+// default matches the previous hardcoded value. Clamped to a positive integer for the
+// same reason (see dependentsScan.ts's SCAN_CONCURRENCY): a negative/fractional override
+// would make forEachWithConcurrency spin up zero workers and silently skip all work.
+const REACHABILITY_CONCURRENCY =
+  Math.max(1, Math.floor(Number(process.env.BLAST_RADIUS_REACHABILITY_CONCURRENCY))) || 4
 
 // blastRadiusDal.getSymbolSpec returns the raw DB row (JSONB columns as
 // unknown); prompts.ts's SymbolSpec is the shape the reachability prompt