feat: packages tb enrichment

backend/src/osspckgs/migrations/V1781539311__packages_tables_sequin_updates.sql

@@ -0,0 +1,30 @@
+-- ─── 1. package_dependencies (created_at, id) index ─────────────────────────
+CREATE INDEX IF NOT EXISTS package_dependencies_created_at_id_idx
+  ON package_dependencies (created_at, id);
+
+-- ─── 2. repo_activity_snapshot replication ──────────────────────────────────
+DO $$
+BEGIN
+    IF EXISTS (
+        SELECT 1 FROM pg_publication WHERE pubname = 'sequin_pub'
+    ) AND NOT EXISTS (
+        SELECT 1 FROM pg_publication_tables
+        WHERE pubname = 'sequin_pub'
+          AND schemaname = 'public'
+          AND tablename = 'repo_activity_snapshot'
+    ) THEN
+        ALTER PUBLICATION sequin_pub ADD TABLE repo_activity_snapshot;
+    END IF;
+END$$;
+
+ALTER TABLE public.repo_activity_snapshot REPLICA IDENTITY FULL;
+
+-- ─── 3. packages enriched health/lifecycle fields (synced back from Tinybird) ───
+ALTER TABLE packages
+  ADD COLUMN IF NOT EXISTS lifecycle_label              text,
+  ADD COLUMN IF NOT EXISTS health_score                 smallint,
+  ADD COLUMN IF NOT EXISTS health_label                 text,
+  ADD COLUMN IF NOT EXISTS maintainer_health_score      smallint,
+  ADD COLUMN IF NOT EXISTS security_supply_chain_score  smallint,
+  ADD COLUMN IF NOT EXISTS development_activity_score   smallint,
+  ADD COLUMN IF NOT EXISTS signal_coverage_health       jsonb;

services/libs/tinybird/datasources/ossPackages_enriched_ds.datasource

@@ -0,0 +1,58 @@
+DESCRIPTION >
+    - `ossPackages_enriched_ds` contains all `ossPackages` metadata plus derived enrichment fields, materialized by `ossPackages_enriched.pipe` (daily COPY, replace mode).
+    - Carries every column from the `ossPackages` datasource verbatim, so it can serve as a drop-in enriched replacement for package analytics.
+    - `lifecycleLabel` is the categorical maintenance state of the package's primary repository, derived from repo + activity-snapshot signals: 'active', 'stable', 'declining', 'abandoned', or 'archived'.
+    - `healthScore` is the composite 0–100 health score = `maintainerHealthScore` (≤40) + `securitySupplyChainScore` (≤35) + `developmentActivityScore` (≤25).
+    - `healthLabel` buckets `healthScore`: 'excellent' (85+), 'healthy' (70–84), 'fair' (50–69), 'concerning' (30–49), 'critical' (<30).
+    - `maintainerHealthScore`, `securitySupplyChainScore`, `developmentActivityScore` are the three health sub-totals.
+    - `signalCoverageHealth` is a JSON object mapping each health sub-signal to 'available' | 'partial' | 'blocked', so the UI can flag which scores reflect real data vs. gaps.
+    - `impact` (carried verbatim from `ossPackages`) is the criticality impact score and serves as the Impact total score.
+    - All other fields mirror `ossPackages`; see `ossPackages.datasource` for per-field documentation.
+
+TAGS "OSS packages", "Enrichment"
+
+SCHEMA >
+    `id` UInt64,
+    `purl` String,
+    `ecosystem` String,
+    `namespace` Nullable(String),
+    `name` String,
+    `registryUrl` Nullable(String),
+    `status` Nullable(String),
+    `description` Nullable(String),
+    `homepage` Nullable(String),
+    `declaredRepositoryUrl` Nullable(String),
+    `repositoryUrl` Nullable(String),
+    `licenses` Array(String),
+    `licensesRaw` Nullable(String),
+    `keywords` Array(String),
+    `distTagsLatest` Nullable(String),
+    `distTagsNext` Nullable(String),
+    `distTagsBeta` Nullable(String),
+    `versionsCount` Nullable(UInt32),
+    `latestVersion` Nullable(String),
+    `firstReleaseAt` Nullable(DateTime64(3)),
+    `latestReleaseAt` Nullable(DateTime64(3)),
+    `dependentCount` Nullable(UInt32),
+    `transitiveDependentCount` Nullable(UInt64),
+    `dependentReposCount` Nullable(UInt32),
+    `hasCriticalVulnerability` UInt8,
+    `impact` Nullable(String),
+    `isCritical` UInt8,
+    `lastRankPassAt` Nullable(DateTime64(3)),
+    `downloadsLast30d` Nullable(UInt64),
+    `centralityScore` Nullable(String),
+    `rankInEcosystem` Nullable(UInt32),
+    `ingestionSource` Nullable(String),
+    `lastSyncedAt` DateTime64(3),
+    `createdAt` DateTime64(3),
+    `lifecycleLabel` String,
+    `healthScore` UInt8,
+    `healthLabel` String,
+    `maintainerHealthScore` UInt8,
+    `securitySupplyChainScore` UInt8,
+    `developmentActivityScore` UInt8,
+    `signalCoverageHealth` String
+
+ENGINE MergeTree
+ENGINE_SORTING_KEY ecosystem, purl

services/libs/tinybird/datasources/repoActivitySnapshot.datasource

@@ -0,0 +1,41 @@
+DESCRIPTION >
+    - `repoActivitySnapshot` holds per-repository activity health metrics over a rolling window (default 12 months).
+    - Replicated from Postgres packages-db — computed by the github-repos-enricher worker from the GitHub API (commits, PRs, issues).
+    - One row per repo; a row is absent until the enricher has reached that repo, so consumers must treat a missing row as "no signal" (degraded path).
+    - Used to derive package lifecycle (active / stable / declining / abandoned) by joining repos -> packageRepos -> packages.
+    - `repoId` links to the parent repos row — the primary key.
+    - `snapshotAt` is when this snapshot was computed — also the updatedAt watermark for Tinybird sync.
+    - `windowMonths` is the rolling window length the metrics were computed over (default 12).
+    - `commitsLast12m`, `commitsLast6m`, `commitsPrior6m` are commit counts for the trailing 12m, the most recent 6m, and the 6m before that (NULL if not computed).
+    - `prsOpenedLast12m`, `prsMergedLast12m`, `prsClosedUnmerged12m` are PR counts opened / merged / closed-without-merge in the trailing 12m (NULL if not computed).
+    - `prMedianTimeToMergeHours` is the median hours from PR open to merge (NULL if no merged PRs in window).
+    - `prMedianTimeToFirstResponseHours` is the median hours to first non-author response on a PR (NULL if no PRs or no responses in window).
+    - `issuesOpenedLast12m`, `issuesClosedLast12m` are issue counts opened / closed in the trailing 12m (NULL if not computed).
+    - `issuesOpenedLast6m`, `issuesOpenedPrior6m` are issues opened in the most recent 6m and the 6m before that (NULL if not computed).
+    - `issuesOpenNow` is the current count of open issues (NULL if not computed).
+    - `issueMedianTimeToCloseHours` is the median hours from issue open to close (NULL if no closed issues in window).
+    - `issueMedianTimeToFirstResponseHours` is the median hours to first non-author response on an issue (NULL if no issues or no responses in window).
+
+SCHEMA >
+    `repoId` UInt64 `json:$.record.repo_id`,
+    `snapshotAt` DateTime64(3) `json:$.record.snapshot_at`,
+    `windowMonths` UInt16 `json:$.record.window_months` DEFAULT 12,
+    `commitsLast12m` Nullable(Int32) `json:$.record.commits_last_12m`,
+    `commitsLast6m` Nullable(Int32) `json:$.record.commits_last_6m`,
+    `commitsPrior6m` Nullable(Int32) `json:$.record.commits_prior_6m`,
+    `prsOpenedLast12m` Nullable(Int32) `json:$.record.prs_opened_last_12m`,
+    `prsMergedLast12m` Nullable(Int32) `json:$.record.prs_merged_last_12m`,
+    `prsClosedUnmerged12m` Nullable(Int32) `json:$.record.prs_closed_unmerged_12m`,
+    `prMedianTimeToMergeHours` Nullable(Int32) `json:$.record.pr_median_time_to_merge_hours`,
+    `prMedianTimeToFirstResponseHours` Nullable(Int32) `json:$.record.pr_median_time_to_first_response_hours`,
+    `issuesOpenedLast12m` Nullable(Int32) `json:$.record.issues_opened_last_12m`,
+    `issuesClosedLast12m` Nullable(Int32) `json:$.record.issues_closed_last_12m`,
+    `issuesOpenedLast6m` Nullable(Int32) `json:$.record.issues_opened_last_6m`,
+    `issuesOpenedPrior6m` Nullable(Int32) `json:$.record.issues_opened_prior_6m`,
+    `issuesOpenNow` Nullable(Int32) `json:$.record.issues_open_now`,
+    `issueMedianTimeToCloseHours` Nullable(Int32) `json:$.record.issue_median_time_to_close_hours`,
+    `issueMedianTimeToFirstResponseHours` Nullable(Int32) `json:$.record.issue_median_time_to_first_response_hours`
+
+ENGINE ReplacingMergeTree
+ENGINE_SORTING_KEY repoId
+ENGINE_VER snapshotAt