feat: resolve nuget owner handles via github contributor verification [CM-1341]

[mbani01]

This pull request refactors and enhances the extraction of candidate GitHub handles from package registries (NuGet and RubyGems) to improve maintainability and consistency. It introduces a shared utility for generating handle candidates, updates the NuGet extractor to emit owner handles, and simplifies the RubyGems extractor logic.

Handle extraction improvements:

• Added a new utility function toHandleCandidates in handles.ts to generate deduplicated, provenance-rich candidate GitHub handles for maintainers. This function is now used by both NuGet and RubyGems extractors to standardize candidate handle generation.

NuGet extractor enhancements:

• Updated nuget.ts to fetch and emit candidate owner handles from the NuGet search API, using the new toHandleCandidates utility. The extractor now returns these candidates in the handleCandidates field, improving downstream corroboration of maintainers. [1] [2] [3]

RubyGems extractor simplification:

• Refactored mapRubygemsOwnerHandles in rubygems.ts to use the shared toHandleCandidates function, reducing code duplication and improving clarity. [1] [2]

[cursor]

PR Summary

Low Risk
Additive registry metadata and refactor only; candidates remain unverified until existing verifyHandleCandidates runs, with search failures swallowed as empty lists.

Overview
NuGet security-contact extraction now pulls package owner usernames from the NuGet search API (resolved via the V3 service index, same pattern as fetchSearch) and returns them as handleCandidates for downstream GitHub contributor verification. Version lookup and owner fetch run in parallel; candidates are still returned when nuspec fetch fails.

A shared toHandleCandidates helper deduplicates registry strings into tier-B github-handle maintainer candidates with provenance. RubyGems mapRubygemsOwnerHandles is refactored to use it instead of inline logic.

resolveEndpoints in the NuGet client is exported so the security-contacts extractor can resolve the search base URL without duplicating service-index logic.

^{Reviewed by Cursor Bugbot for commit bf5172c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

Introduces shared registry-handle candidate generation and adds NuGet owner candidates for downstream GitHub contributor verification.

Changes:

• Adds deduplicated, provenance-rich handle candidate generation.
• Extracts NuGet owner handles from search results.
• Reuses the utility for RubyGems owners.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
handles.ts	Adds shared candidate generation.
nuget.ts	Fetches and maps NuGet owners.
rubygems.ts	Reuses shared handle mapping.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bf5172c. Configure here.}

[cursor]

Candidates lost on fetch errors

Medium Severity

fetchNuget loads owner handleCandidates in parallel with the version index, but a thrown error from latestStableVersion (via Promise.all) or from the later nuspec fetchText rejects the whole extractor. extractManifest then skips the package, discarding handle candidates that were already fetched successfully.

 

^{Reviewed by Cursor Bugbot for commit bf5172c. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.