feat: resolve rubygems owner handles via github contributor verification [CM-1341] - #4363
Conversation
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
PR SummaryMedium Risk Overview RubyGems owners without email now emit Reviewed by Cursor Bugbot for commit 5fdec8e. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit 31ad2eb. Configure here.
There was a problem hiding this comment.
Pull request overview
Adds verified RubyGems owner handles to the security-contact extraction pipeline.
Changes:
- Extracts and deduplicates RubyGems handle candidates.
- Verifies candidates against repository ownership and contributors.
- Integrates verified handles into contact reconciliation and email resolution.
Reviewed changes
Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
verifyHandleCandidates.ts |
Verifies candidate GitHub handles. |
types.ts |
Extends extractor results with handle candidates. |
processBatch.ts |
Integrates candidate verification. |
rubygems.ts |
Extracts RubyGems owner handles. |
registry/index.ts |
Aggregates candidate handles across packages. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.
Comments suppressed due to low confidence (1)
services/apps/packages_worker/src/security-contacts/verifyHandleCandidates.ts:51
- A contributor lookup failure also drops candidates whose handle already matches the repository owner, although that match is independently corroborated by
target.url. GitHub can transiently return 202/rate-limit errors here, so preserve owner matches and only fall back from contributor verification.
return []
This pull request enhances the security contacts extraction process by introducing a mechanism to identify and verify registry usernames that might correspond to GitHub handles, but require corroboration before being accepted as valid contacts. The changes mainly add support for handling such "handle candidates" (especially for RubyGems), collecting them during extraction, and confirming their association with a repository via contributor checks before inclusion.
New candidate handle extraction and verification:
mapRubygemsOwnerHandlesinrubygems.tsto extract possible GitHub handles from RubyGems owners, marking them as candidates that require further verification.fetchRubygems) to return both direct contacts and these handle candidates.ExtractorResultintypes.ts) to include an optionalhandleCandidatesfield.extractManifestinindex.ts) to collect and deduplicate handle candidates from all fetchers. [1] [2] [3]Handle candidate verification and integration:
verifyHandleCandidates.ts, which verifies candidate handles by checking if they are the repo owner or a top-100 contributor, only accepting corroborated handles as contacts.processBatch.tsto collect all handle candidates from extractors, verify them using the new function, and only then add them to the final contacts list. [1] [2] [3]These changes improve the accuracy and reliability of GitHub handle extraction from package registries, reducing the risk of false positives.