feat: get rubygems owners as security-contacts [CM-1241] - #4328
Conversation
|
|
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
8640054 to
68a00e4
Compare
mbani01
changed the title
There was a problem hiding this comment.
Pull request overview
Adds RubyGems owner emails to security-contact extraction alongside gem metadata.
Changes:
- Fetches gem metadata and owners concurrently.
- Validates and deduplicates owner emails.
- Tolerates owner API failures.
Review note: Owner metadata can be lost during deduplication, and transient failures can remove existing contacts. The PR title also lacks the required JIRA key.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
| fetchJson(ownersUrl, timeoutMs, registryHeaders(userAgent)).catch(() => ({ | ||
| status: 0, | ||
| json: null, | ||
| })), |
|
|
||
| const acts = proxyActivities<typeof activities>({ | ||
| startToCloseTimeout: '30 minutes', | ||
| startToCloseTimeout: '60 minutes', |
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
Reviewed by Cursor Bugbot for commit 87c24a3. Configure here.
| status: 0, | ||
| json: null, | ||
| })), | ||
| ]) |
There was a problem hiding this comment.
Gem failure drops owner contacts
Medium Severity
fetchRubygems loads gem metadata and owners in parallel via Promise.all, but only the owners fetchJson call is wrapped in .catch. When the gem request errors (timeout, rate limit after retries, or non-absent HTTP status), the whole Promise.all rejects and owner emails from a successful owners response are never merged.
Reviewed by Cursor Bugbot for commit 87c24a3. Configure here.
| const [gemResult, ownersResult] = await Promise.all([ | ||
| fetchJson(gemUrl, timeoutMs, registryHeaders(userAgent)), | ||
| fetchJson(ownersUrl, timeoutMs, registryHeaders(userAgent)).catch(() => ({ | ||
| status: 0, | ||
| json: null, | ||
| })), |
|
|
||
| const acts = proxyActivities<typeof activities>({ | ||
| startToCloseTimeout: '30 minutes', | ||
| startToCloseTimeout: '60 minutes', |
This pull request enhances the RubyGems extractor in the
packages_workerservice to improve the discovery of maintainer contact information. The main improvement is the addition of logic to fetch and process owner email addresses from the RubyGems registry, supplementing the previous extraction from the gem metadata. This increases the accuracy and coverage of maintainer contact extraction.Enhancements to RubyGems contact extraction:
mapRubygemsOwnersto extract maintainer emails from the RubyGems owners API, ensuring only valid and unique email addresses are included.fetchRubygemsto fetch both the gem metadata and the owners list, merging contacts from both sources while avoiding duplicates.isEmailutility for validating email addresses.Note
Low Risk
Adds outbound registry reads and more maintainer email data in the security-contacts pipeline; no auth or persistence schema changes in this diff.
Overview
RubyGems security-contact extraction now pulls maintainer emails from the registry owners API in addition to emails embedded in gem
authorsmetadata.fetchRubygemsparallel-fetchesgems/{name}.jsonandgems/{name}/owners.json, merges both contact lists, and treats owners fetch failures as non-fatal so gem metadata still works. NewmapRubygemsOwnersvalidates emails withisEmail, dedupes case-insensitively, and maps RubyGemshandleto contactname(nothandle) so it is not mistaken for a GitHub login during identity merge.The RubyGems package ingestion Temporal workflow raises activity
startToCloseTimeoutfrom 30 to 60 minutes, likely to accommodate the extra registry work per batch.Reviewed by Cursor Bugbot for commit 87c24a3. Bugbot is set up for automated code reviews on this repo. Configure here.