feat: add enriched fields (CM-1285)

[ulemons]

Summary

Exposes Tinybird-enriched package health fields in the self-serve package detail API (GET /packages/detail, /akrites/packages/detail). These columns were added to the packages table in PR #4243 and are now returned in the response instead of being omitted or null.

Changes

• data-access-layer — getPackageDetailByPurl: adds 7 new columns to the SQL SELECT (health_score, health_label, maintainer_health_score, security_supply_chain_score, development_activity_score, lifecycle_label, signal_coverage_health) and extends PackageDetailRow with the corresponding typed fields.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1285

---

Note

Medium Risk
Public package-detail response semantics change for healthScore and new fields; clients that assumed Scorecard-derived health may see different values when Tinybird data exists.

Overview
Package detail (GET /packages/detail) now returns Tinybird-enriched health data from packages instead of deriving health mostly from OpenSSF Scorecard.

getPackageDetailByPurl selects seven new columns (health_score, breakdown scores, lifecycle_label, signal_coverage_health) and maps them on PackageDetailRow. The handler returns healthScore and healthScoreDetails (total, label, maintainer/security/development subscores) from those fields, sets riskSignals.lifecycle from lifecycleLabel, and adds top-level signalCoverageHealth. healthBand still uses computeHealthBand, but the input is Tinybird healthScore / 10 when present, otherwise Scorecard as before.

OpenAPI PackageDetail is updated to document the new fields and examples (replacing the old “scorecard × 10 only” health shape).

^{Reviewed by Cursor Bugbot for commit 11fa261. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR expands the public package detail API (GET /packages/detail and Akrites equivalent) to surface Tinybird-enriched package health fields that already exist on the packages table, so clients no longer receive omitted/null health breakdown and lifecycle data.

Changes:

• Extended getPackageDetailByPurl (DAL) to select and type seven Tinybird-enriched columns (health_*, component scores, lifecycle_label, signal_coverage_health).
• Updated the public v1 getPackage handler to return the enriched health totals/breakdown, lifecycle label, and signalCoverageHealth.
• Updated the public OpenAPI spec to include a health “label” field and the signalCoverageHealth property.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
services/libs/data-access-layer/src/osspckgs/api.ts	Selects Tinybird-enriched health/lifecycle columns and exposes them via PackageDetailRow.
backend/src/api/public/v1/packages/getPackage.ts	Maps the new DAL fields into the public API response.
backend/src/api/public/v1/packages/openapi.yaml	Documents signalCoverageHealth and adds a health label field.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 11fa261. Configure here.}

[cursor]

healthScoreDetails never null

Medium Severity

The handler always builds a healthScoreDetails object with nullable fields, but the updated OpenAPI schema says that property stays null until Tinybird enrichment. Unenriched package responses therefore expose an empty breakdown object instead of null, which breaks clients that gate UI on a missing healthScoreDetails.

Additional Locations (1)

• backend/src/api/public/v1/packages/openapi.yaml#L274-L279

 

^{Reviewed by Cursor Bugbot for commit 11fa261. Configure here.}