feat: align health score v2 with community feedback commitments IN-1226

[gaspergrom]

Summary

• Implements 8 compliance-gap items from IN-1226, all Tinybird-only changes, already deployed and validated against production data.
• Key changes: lifecycle-stage split (abandoned vs inert), bus factor observed-activity fallback, vulnerability severity filter correction (MODERATE→MEDIUM), methodology versioning + monthly raw-input snapshot datasource, bot-filtering join fix, non-author responsiveness fix, and documentation of experimental-repo exclusion + weighted-mean bus-factor prototype.
• No deploy step needed — all pipes/datasources are already live in production Tinybird.

JIRA

IN-1226

[cursor]

PR Summary

Medium Risk
Changes alter published health scores, lifecycle labels, and security vuln penalties across all repos; issue responsiveness and activity source switches can shift maintainer metrics materially.

Overview
Tinybird-only updates for Health Score v2 (IN-1226): methodology 2.0.0 is stamped on category and aggregate outputs, and a monthly append pipe/datasource captures raw scoring inputs (not computed scores) for audit and validation.

Scoring and upstream fixes: Maintainer bus factor uses max(curated maintainers, observed review/merge actors) and reads activity from activityRelations_deduplicated_cleaned_bucket_union. Lifecycle splits the old long-idle case into abandoned (unanswered issues + no maintainer activity) vs inert (18mo idle with no issues/PRs). Open vuln counts use severity MEDIUM instead of the non-matching MODERATE. Issue responsiveness ignores the opener’s own comments. Project breakdown adds busFactorScoreActivityWeightedMean.

Docs: README documents repositories.excluded for out-of-scope repos; repo copy datasource text now describes Layer 1+2 graceful degradation.

^{Reviewed by Cursor Bugbot for commit 310860e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 4 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 310860e. Configure here.}

[cursor]

Inert label breaks project rollup

High Severity

The new inert lifecycle label is emitted by health_score_v2_lifecycle.pipe, but project_insights_copy.pipe's best-state-wins indexOf list still only has active/stable/declining/abandoned/archived. ClickHouse returns 0 for a missing value, so inert sorts ahead of every other state and can override active at project level.

 

^{Reviewed by Cursor Bugbot for commit 310860e. Configure here.}

[cursor]

Abandoned misses NULL lastCommitAt

Medium Severity

The new abandoned branch requires lastCommitAt < now() - INTERVAL 12 MONTH, but this pipe already documents that repos.lastCommitAt is often NULL as an upstream data gap. In ClickHouse that comparison is false for NULL, so repos with unanswered issues and no recent commits can still fall through to active.

 

^{Reviewed by Cursor Bugbot for commit 310860e. Configure here.}

[cursor]

Weighted mean coalesce asymmetry

Medium Severity

busFactorScoreActivityWeightedMean uses coalesce(commitsLast6m, 0) in the numerator and coalesce(commitsLast6m, 1) in the denominator. Repos with busFactorAvailable but NULL commitsLast6m add weight without contributing score, which dilutes the activity-weighted mean.

 

^{Reviewed by Cursor Bugbot for commit 310860e. Configure here.}

[cursor]

New pipe omits FINAL keyword

Low Severity

The new snapshot pipe reads repositories with SELECT DISTINCT ... WHERE deletedAt IS NULL and no FINAL. repositories is a ReplacingMergeTree, so unmerged soft-delete versions can still surface without FINAL.

 

^{Triggered by learned rule: Tinybird pipes querying ReplacingMergeTree datasources must use FINAL keyword}

^{Reviewed by Cursor Bugbot for commit 310860e. Configure here.}

[Copilot]

Pull request overview

Aligns Health Score v2 Tinybird pipelines with IN-1226 requirements.

Changes:

• Adds lifecycle, bus-factor, responsiveness, and vulnerability corrections.
• Introduces methodology versioning and monthly raw-input snapshots.
• Documents repository exclusion and adds weighted bus-factor aggregation.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 11 comments.

Show a summary per file

File	Description
services/libs/tinybird/README.md	Documents repository exclusion.
services/libs/tinybird/pipes/project_insights_health_breakdown_copy.pipe	Adds activity-weighted bus-factor aggregation.
services/libs/tinybird/pipes/issue_analysis_copy_pipe.pipe	Measures non-author issue responses.
services/libs/tinybird/pipes/health_score_v2.pipe	Adds methodology version.
services/libs/tinybird/pipes/health_score_v2_signal_detail.pipe	Exposes methodology version.
services/libs/tinybird/pipes/health_score_v2_security.pipe	Corrects medium severity and versions output.
services/libs/tinybird/pipes/health_score_v2_raw_inputs_snapshot.pipe	Adds monthly raw-input snapshots.
services/libs/tinybird/pipes/health_score_v2_maintainer.pipe	Adds observed-actor bus-factor fallback.
services/libs/tinybird/pipes/health_score_v2_lifecycle.pipe	Splits abandoned and inert states.
services/libs/tinybird/pipes/health_score_v2_development.pipe	Adds methodology version.
services/libs/tinybird/datasources/vulnerabilities.datasource	Corrects severity documentation.
services/libs/tinybird/datasources/project_insights_health_breakdown_ds.datasource	Stores weighted bus-factor metric.
services/libs/tinybird/datasources/health_score_v2_signal_detail_ds.datasource	Stores methodology version.
services/libs/tinybird/datasources/health_score_v2_security_ds.datasource	Stores methodology version.
services/libs/tinybird/datasources/health_score_v2_repo_copy_ds.datasource	Updates scoring documentation and schema.
services/libs/tinybird/datasources/health_score_v2_raw_inputs_snapshot_ds.datasource	Defines snapshot storage.
services/libs/tinybird/datasources/health_score_v2_maintainer_ds.datasource	Stores methodology version.
services/libs/tinybird/datasources/health_score_v2_lifecycle_ds.datasource	Stores lifecycle methodology version.
services/libs/tinybird/datasources/health_score_v2_development_ds.datasource	Stores methodology version.

Suppressed comments (2)

services/libs/tinybird/pipes/health_score_v2_lifecycle.pipe:62

• Introducing inert here leaves the project rollup unaware of the new value. project_insights_copy.pipe:130 uses indexOf(['active', 'stable', 'declining', 'abandoned', 'archived'], x); indexOf returns 0 for inert, so a mixed active/inert project incorrectly rolls up to inert instead of the best state. Add inert between declining and abandoned in that ordering and update the associated lifecycle descriptions.

                    'inert',

services/libs/tinybird/pipes/health_score_v2_raw_inputs_snapshot.pipe:220

• These PR inputs also diverge from health_score_v2_development.pipe:216-225: old PRs merged/closed recently are included and the median spans all history, whereas scoring starts with PRs opened in the trailing 12 months. Use the same window as the category pipe so snapshots remain auditable.

                countIf(mergedAt IS NOT NULL AND mergedAt > now() - INTERVAL 12 MONTH) AS merged12m,
                countIf(
                    closedAt IS NOT NULL AND mergedAt IS NULL AND closedAt > now() - INTERVAL 12 MONTH
                ) AS closedUnmerged12m,
                quantile(0.5)
                (mergedInSeconds) AS medianMergeS

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.