feat: import manual maintainers (CM-1299) - #4292
Merged
Merged
Conversation
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Pull request overview
This PR adds ingestion_source tracking to the package_maintainers table so manually-imported maintainer links can be distinguished from auto-enriched ones and rolled back or audited independently. It also plumbs github_login persistence through the maintainers upsert and introduces two operational scripts to fetch candidate Maven maintainers into a review CSV and then import that CSV into the osspckgs DB.
Changes:
- Schema/Tinybird: add nullable
ingestion_sourcecolumn topackage_maintainersand replicate it downstream. - DAL: add
insertPackageMaintainerLink(insert-only,ON CONFLICT DO NOTHING) with optionalingestionSource, and persist/trackgithub_logininupsertMaintainer; extend the corresponding types. - Scripts:
fetchMavenMaintainers.tsbuilds a review CSV from Libraries.io / POM SCM / GitHub;importMaintainersFromCsv.tsloads it with per-package transactions,--dry-run, and a generated rollback SQL.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| backend/src/osspckgs/migrations/V1782978597__package_maintainers_ingestion_source.sql | Adds nullable ingestion_source column (additive, IF NOT EXISTS). |
| services/libs/tinybird/datasources/packageMaintainers.datasource | Adds ingestionSource field to the replicated schema; DESCRIPTION not updated. |
| services/libs/data-access-layer/src/osspckgs/types.ts | Adds optional githubLogin and ingestionSource fields to upsert types. |
| services/libs/data-access-layer/src/osspckgs/maintainers.ts | Persists/tracks github_login; adds insertPackageMaintainerLink with ingestionSource. |
| services/apps/packages_worker/src/maven/scripts/fetchMavenMaintainers.ts | New script producing a maintainer-candidate CSV for manual review. |
| services/apps/packages_worker/src/maven/scripts/importMaintainersFromCsv.ts | New import script writing links with ingestion_source = 'manual_csv' plus rollback SQL. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+31
to
+35
| function parseCsv(content: string): Record<string, string>[] { | ||
| const rows: string[][] = [] | ||
| let cur = '' | ||
| let inQuote = false | ||
| let row: string[] = [] |
ulemons
force-pushed
the
feat/import-manual-maintianers
branch
from
July 2, 2026 13:15
33bf373 to
4e22c9e
Compare
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit d264758. Configure here.
ulemons
force-pushed
the
feat/import-manual-maintianers
branch
from
July 2, 2026 14:58
d264758 to
5040801
Compare
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org>
ulemons
force-pushed
the
feat/import-manual-maintianers
branch
from
July 3, 2026 07:04
5040801 to
f3852ca
Compare
skwowet
pushed a commit
that referenced
this pull request
Jul 3, 2026
Signed-off-by: Umberto Sgueglia <usgueglia@contractor.linuxfoundation.org> Signed-off-by: Yeganathan S <63534555+skwowet@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds
ingestion_sourcetracking topackage_maintainersto distinguish manually-imported maintainer records from automatically-enriched ones. This makes it possible to audit, update, or roll back manual entries independently.Changes
V1782978597__package_maintainers_ingestion_source.sql): addsingestion_source textcolumn topackage_maintainers— nullable so existing rows default tonull(meaning auto-enriched, pre-column)packageMaintainers.datasource): addsingestionSourcefield to replicate the new column downstreamosspckgs/maintainers.ts): addsingestionSourceoptional param toinsertPackageMaintainerLink; usesselectOneOrNoneinstead ofselectOne().catch(() => null)to avoid swallowing real DB errorsosspckgs/types.ts): adds optionalingestionSourcefield toIDbPackageMaintainerUpsertimportMaintainersFromCsv.ts): passesingestion_source = 'manual_csv'on insert; existing links (DO NOTHING on conflict) are never overwritten — preserves the source of records that were already in the DBType of change
JIRA ticket
CM-1299
Note
Medium Risk
replacePackageMaintainersbehavior changed for all Maven/NuGet enrichment: manual links are preserved but auto-sync no longer updates roles on conflicting package–maintainer pairs (DO NOTHING). Nullable schema migration is low risk; operational imports write production osspckgs data.Overview
Adds
ingestion_sourceonpackage_maintainersso manual CSV imports (manual_csv) are auditable and separable from auto-enrichment, with Tinybird replicating the new field.The DAL gains
insertPackageMaintainerLink(idempotent insert with optional source),upsertMaintainernow persistsgithub_login, andcontributoras a link role.replacePackageMaintainersonly deletes/replaces non-manual_csvlinks and uses ON CONFLICT DO NOTHING on re-insert so manual rows are not overwritten when Maven/NuGet enrichment runs.import:maven-maintainersruns a script that upserts maintainers from reviewed CSV, writes links taggedmanual_csv, and emits a rollback SQL file.fetchMavenMaintainers.ts(offline tooling) enriches a package list via Libraries.io, POM SCM, and GitHub (CODEOWNERS / MAINTAINERS / contributors) into import-ready CSV.Reviewed by Cursor Bugbot for commit f3852ca. Bugbot is set up for automated code reviews on this repo. Configure here.