fix: comments

Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>

Author: ulemons

backend/src/api/public/v1/packages/blastRadiusBatch.ts

@@ -29,8 +29,8 @@ export const blastRadiusJobBatchRequestSchema = z.object({
 export type BlastRadiusJobBatchRequest = z.infer<typeof blastRadiusJobBatchRequestSchema>
 
 // Unlike the read batches (purls that may or may not resolve to a package), every
-// job in a submit batch is genuinely submitted — there is no "not found" case, so
-// the response is a plain array in request order, not a found/not-found wrapper.
+// requested job produces a response entry — there is no "not found" case, so the
+// response is a plain array in request order, not a found/not-found wrapper.
 const analysisIdSchema = z.uuid()
 
 export const blastRadiusJobPollBatchRequestSchema = z.object({

backend/src/api/public/v1/packages/getBlastRadiusJobBatch.test.ts

@@ -137,6 +137,47 @@ describe('getBlastRadiusJobBatch', () => {
     })
   })
 
+  it('matches an uppercase requestedAnalysisId against its (lowercase) row and echoes the original case', async () => {
+    const uppercaseId = DONE_ID.toUpperCase()
+    const { req, res, json } = mockReqRes({ analysisIds: [uppercaseId] })
+
+    getAnalysisDetailsByIds.mockResolvedValue([
+      {
+        id: DONE_ID,
+        advisory_osv_id: 'GHSA-652q-gvq3-74qv',
+        package_name: 'lodash',
+        ecosystem: 'npm',
+        status: 'done',
+        error: null,
+        candidates_considered: 10,
+        started_at: '2026-07-01T00:00:00.000Z',
+        completed_at: '2026-07-01T01:00:00.000Z',
+      },
+    ])
+    getVerdictResultsBatch.mockResolvedValue([
+      {
+        analysisId: DONE_ID,
+        name: 'benchmark.js',
+        version: '2.1.4',
+        downloads: 500000,
+        reachable_verdict: 'affected',
+        confidence: 0.9,
+        evidence: null,
+        reasoning: 'uses merge',
+      },
+    ])
+    getDependentsExcludedByRangeCountBatch.mockResolvedValue([{ analysisId: DONE_ID, count: 8 }])
+
+    await getBlastRadiusJobBatch(req, res)
+
+    const [{ results }] = json.mock.calls[0]
+    expect(results[0]).toMatchObject({ requestedAnalysisId: uppercaseId, found: true })
+    expect(results[0].analysis).toMatchObject({
+      status: 'done',
+      summary: expect.objectContaining({ dependentsExcludedUpfront: 8 }),
+    })
+  })
+
   it('rejects a batch with a malformed uuid without querying the database', async () => {
     const { req, res } = mockReqRes({ analysisIds: [PENDING_ID, 'not-a-uuid'] })
 

backend/src/api/public/v1/packages/getBlastRadiusJobBatch.ts

@@ -26,7 +26,10 @@ export async function getBlastRadiusJobBatch(req: Request, res: Response): Promi
   const qx = await getPackagesQx()
 
   const analysisRows = await blastRadiusDal.getAnalysisDetailsByIds(qx, pagedAnalysisIds)
-  const analysisById = new Map(analysisRows.map((row) => [row.id, row]))
+  // Postgres normalizes uuid columns to lowercase on read, but a requested id can be
+  // any case (schema only validates uuid shape) — normalize the lookup key so an
+  // uppercase requestedAnalysisId still matches its (lowercase) row.
+  const analysisById = new Map(analysisRows.map((row) => [row.id.toLowerCase(), row]))
 
   const doneIds = analysisRows.filter((row) => row.status === 'done').map((row) => row.id)
   const [verdictRows, excludedByRangeCounts] = await Promise.all([
@@ -48,7 +51,7 @@ export async function getBlastRadiusJobBatch(req: Request, res: Response): Promi
   )
 
   const results: BlastRadiusAnalysisBulkEntry[] = pagedAnalysisIds.map((requestedAnalysisId) => {
-    const analysis = analysisById.get(requestedAnalysisId)
+    const analysis = analysisById.get(requestedAnalysisId.toLowerCase())
     if (!analysis) {
       return { requestedAnalysisId, found: false, analysis: null }
     }
@@ -58,8 +61,8 @@ export async function getBlastRadiusJobBatch(req: Request, res: Response): Promi
       found: true,
       analysis: toBlastRadiusAnalysis(
         analysis,
-        verdictsByAnalysisId.get(requestedAnalysisId) ?? [],
-        excludedByRangeCountByAnalysisId.get(requestedAnalysisId) ?? 0,
+        verdictsByAnalysisId.get(analysis.id) ?? [],
+        excludedByRangeCountByAnalysisId.get(analysis.id) ?? 0,
       ),
     }
   })

services/apps/packages_worker/src/bin/blast-radius-worker.ts

@@ -1,5 +1,6 @@
 import { Config } from '@crowd/archetype-standard'
 import { Options, ServiceWorker } from '@crowd/archetype-worker'
+import { SlackChannel } from '@crowd/slack'
 
 // Own ServiceWorker instance rather than the shared one in ../service (used by every
 // other packages_worker entry point) — its activities are CPU/IO-heavy (tarball
@@ -17,6 +18,7 @@ const config: Config = {
 const options: Options = {
   postgres: { enabled: false }, // packages-db is managed via getPackagesDb()
   maxConcurrentActivityTaskExecutions: 16,
+  alertChannel: SlackChannel.CDP_AKRITES_ALERTS,
 }
 
 const svc = new ServiceWorker(config, options)

services/apps/packages_worker/src/blast-radius/stages/dependents.ts

@@ -55,6 +55,14 @@ export async function runDependentsStage(
       signal,
     })
 
+    // scanDependents stops its loops early on abort but still returns whatever it
+    // gathered so far — without this check, a cancelled/timed-out attempt would
+    // persist that partial set and complete the stage successfully, and a Temporal
+    // retry would then see it as already succeeded and skip re-scanning.
+    if (signal?.aborted) {
+      throw new Error('Dependents scan cancelled')
+    }
+
     // Resolve package_id for the analyzed set only (max topN=25) — these are the ones
     // actually surfaced in results/verdicts. excludedByRange (up to 200) never
     // reaches a result, so resolving it too would just be extra queries for nothing.

services/apps/packages_worker/src/blast-radius/workflows.ts

@@ -41,9 +41,11 @@ const { blastRadiusReachability } = proxyActivities<typeof activities>({
   retry: { maximumAttempts: 2 },
 })
 
+// No heartbeatTimeout — runReportStage doesn't heartbeat until after it completes
+// (see activities.ts), so any run taking over a minute would otherwise always
+// heartbeat-timeout and retry before its first heartbeat.
 const { blastRadiusReport } = proxyActivities<typeof activities>({
   startToCloseTimeout: '2 minutes',
-  heartbeatTimeout: '1 minute',
   retry: { maximumAttempts: 3 },
 })