feat: resolve nuget owner handles via github contributor verification [CM-1341] - #4364
Conversation
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
PR SummaryLow Risk Overview A shared
Reviewed by Cursor Bugbot for commit bf5172c. Bugbot is set up for automated code reviews on this repo. Configure here. |
|
|
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
mbani01
changed the title
There was a problem hiding this comment.
Pull request overview
Introduces shared registry-handle candidate generation and adds NuGet owner candidates for downstream GitHub contributor verification.
Changes:
- Adds deduplicated, provenance-rich handle candidate generation.
- Extracts NuGet owner handles from search results.
- Reuses the utility for RubyGems owners.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
handles.ts |
Adds shared candidate generation. |
nuget.ts |
Fetches and maps NuGet owners. |
rubygems.ts |
Reuses shared handle mapping. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
Signed-off-by: Mouad BANI <mouad-mb@outlook.com>
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 1 potential issue.
❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.
Reviewed by Cursor Bugbot for commit bf5172c. Configure here.
| if (!text) return { contacts: [], policies: {} } | ||
| return { contacts: mapNuspec(text, url, new Date().toISOString()), policies: {} } | ||
| if (!text) return { contacts: [], policies: {}, handleCandidates } | ||
| return { contacts: mapNuspec(text, url, fetchedAt), policies: {}, handleCandidates } |
There was a problem hiding this comment.
Candidates lost on fetch errors
Medium Severity
fetchNuget loads owner handleCandidates in parallel with the version index, but a thrown error from latestStableVersion (via Promise.all) or from the later nuspec fetchText rejects the whole extractor. extractManifest then skips the package, discarding handle candidates that were already fetched successfully.
Reviewed by Cursor Bugbot for commit bf5172c. Configure here.
| fetchedAt: string, | ||
| ): Promise<RawContact[]> { | ||
| try { | ||
| const { searchBaseUrl } = await resolveEndpoints() |
| sourceUrl: string, | ||
| fetchedAt: string, | ||
| ): RawContact[] { | ||
| const data = (doc as any)?.data |
This pull request refactors and enhances the extraction of candidate GitHub handles from package registries (NuGet and RubyGems) to improve maintainability and consistency. It introduces a shared utility for generating handle candidates, updates the NuGet extractor to emit owner handles, and simplifies the RubyGems extractor logic.
Handle extraction improvements:
toHandleCandidatesinhandles.tsto generate deduplicated, provenance-rich candidate GitHub handles for maintainers. This function is now used by both NuGet and RubyGems extractors to standardize candidate handle generation.NuGet extractor enhancements:
nuget.tsto fetch and emit candidate owner handles from the NuGet search API, using the newtoHandleCandidatesutility. The extractor now returns these candidates in thehandleCandidatesfield, improving downstream corroboration of maintainers. [1] [2] [3]RubyGems extractor simplification:
mapRubygemsOwnerHandlesinrubygems.tsto use the sharedtoHandleCandidatesfunction, reducing code duplication and improving clarity. [1] [2]