[castrojo]

Correction

Replaces merged-PR process cards with an auditable community view: 456 linked GitHub contributor accounts across all 59 public repositories, 148 active in 90 days, and 40 repositories with recent participation.

Counts code/documentation changes, PR authors, issue authors, comments, submitted reviews and native discussions. Stable account IDs are unioned across every public repository, including archives and native fork activity. Known bots, unlinked authors and imported fork git history are excluded; limits are visible.

Integrity

• Exhaustive direct connections and nested comment/review/reply cursors; independent public repository control total.
• Persisted identity ledger; no sums of monthly totals, truncated leaderboard seeds, unsupported ratios or deprecated metric framing.
• Chronological pagination tolerates append-only live activity but still requires complete final totals and honors the snapshot cutoff.
• Canonical bot filtering and generatedAt freshness. Failed reads preserve history and timestamp; sanitized source-stage failures produce Action warnings.
• Scheduled collection uses explicit issues/discussions read permissions and keeps the newest verified snapshot awaiting review.

Verified

• Local full scan independently records 456 accounts across 59 public repositories.
• Action 40143194293, using github.token, completed a real full scan: 996 requests, 539 GraphQL points, 456 accounts, 59 repositories. This is a successful collection, not just a green fail-soft job.
• just check passes: typecheck, lint with zero errors, all repository tests.
• All PR build shards pass. English production preview verified in desktop/light and mobile/dark, including actual canvases, readable axes, accessible tables and no horizontal overflow.
• Relevant skill updates included in this PR.

[hivecommons-hive]

HUMAN DECISION NEEDED — @castrojo confirm the two new read scopes (issues: read, discussions: read) granted to the scheduled workflow's token are intended.

Summary: This change replaces the old merged-pull-request statistics on the analytics page with a count of every GitHub account that has taken part in any public project repository. The collector, charts, docs and the daily refresh job were all rewritten together. The code reads cleanly and the offline tests pass, but the new refresh job will stop and publish a "data unavailable" flag whenever someone opens an issue or pull request while the scan is running, which could happen often on a busy project. The job also asks for two additional read-only permissions, which a maintainer should sign off on.

What I need from you: Confirm the new permissions, and consider the pagination relaxation below.

---

Reviewed at head f8d2b0b (dispatch cited 17f5824; the extra commit is test-only).

correctness

• medium — Live activity during a scan fails the whole refresh. connectionPages requires totalCount to be identical across every page of a connection (scripts/fetch-contributor-metrics.js:214-215) and requires the final count === expected (:221). A single new issue, PR, discussion or comment landing on a repository while its connection is being paged changes totalCount, which throws FAILURE_REASON, is caught per-repo (:535-539), and invalidates the complete run (:542). The output then becomes the retained snapshot with unavailable: true (:160-168), which the workflow commits and force-pushes over the pending data PR (.github/workflows/update-contributor-metrics.yml:77-91), and ContributorMetricsCharts.tsx:158-160 renders it with the unavailable banner. The test at scripts/fetch-contributor-metrics.test.js:505-507 pins this as desired for dropped pages, but it also fires on ordinary growth of a live repository — unlike the REST commit path, which is bounded by until=asOf (:468). Suggested relaxation: allow the total to grow (new items are appended), still fail on shrinkage or short pages:

  --- a/scripts/fetch-contributor-metrics.js
  +++ b/scripts/fetch-contributor-metrics.js
  @@ async function connectionPages(load, visit, initial) {
       expected ??= connection.totalCount;
  -    requireValue(expected === connection.totalCount);
  +    // Items may be added mid-scan; they are appended and paged. Shrinkage still fails.
  +    requireValue(connection.totalCount >= expected);
  +    expected = connection.totalCount;

  (The count === expected check at :221 then compares against the latest total. Add a fixture where page 2 reports totalCount + 1 and an extra node, asserting unavailable: false.)

• low — Commit "changes" events pair the commit author identity with the committer date (scripts/fetch-contributor-metrics.js:470-474). For rebased/squashed/imported history the committer date can be years after authorship, so firstContributionAt (:84-96) and the "Contributors over time" curve reflect landing time, not first contribution. Use commit.commit?.author?.date if authorship time is the intent, or say "first landed" in docs/analytics.mdx:78-80.

security

• low — New token scopes issues: read and discussions: read (.github/workflows/update-contributor-metrics.yml:15-16) alongside the existing contents: write / pull-requests: write. Read-only on public data and needed by the GraphQL issue/discussion queries, so low risk, but a widened grant is a maintainer call. No new triggers, uses: changes, or secret references.

docs-currency

• low — docs/analytics.mdx drops the cross-links to the Factory metrics view and to Linux Foundation Insights (removed at old lines 75-77) without a replacement. Neither is DevStats framing; consider keeping them below the methodology if they are still valid destinations.

style

• low — docs/skills/github-api-client.md:213-214 cites "/websites/github_en_graphql in Context7", a tool-specific library ID. Link the GitHub GraphQL docs URL instead so the reference works without that tool.

No findings from: intent-alignment.

Confidence: 3/5 (needs attention) — 1 medium finding; 1 perspective requires a human decision

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88

[hivecommons-hive]

f8d2b0b

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @castrojo, head f8d2b0b6b21d) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/update-contributor-metrics.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

d4ddb40

ℹ️ Sentinel notice — informational; author is trusted (owner), merge is not blocked

Hive flagged this PR (author @castrojo, head d4ddb408e796) because it matches behaviors that can override security controls, escalate privileges or damage the codebase. This is a heuristic, not an accusation — a maintainer should confirm the change is intended before it merges.

• sensitive_path — changes 1 sensitive path(s) (Touches a sensitive path (OWNERS, workflows, policies, hive config, security docs, …))
  • .github/workflows/update-contributor-metrics.yml

Hive did not add the sentinel-alert label because this author is trusted. The finding remains recorded for audit and the dashboard Security tab; set sentinel.trusted_authors_block: true to require the blocking label for trusted authors too.

[hivecommons-hive]

HUMAN DECISION NEEDED — @castrojo confirm the two new read-only token scopes (issues: read, discussions: read) granted to the daily metrics workflow.

Summary: This change replaces the old "merged pull requests" contributor numbers on the analytics page with a full count of everyone who has participated in any public Bluefin repository. I read the whole change and ran its offline tests; the collector, chart and docs hold together. Two small things: one known image-optimizing robot account is still counted as a person, and two useful links to other metrics pages were dropped from the analytics page. The automated workflow also asks for two extra read-only permissions, which a maintainer should sign off on.

What I need from you: Approve the two new read scopes; optionally apply the two suggestions below.

---

Reviewed head d4ddb40. Ran node --test scripts/fetch-contributor-metrics.test.js locally: 17/17 pass. contributor-charts.test.js not run here (needs npm ci; author reports it passing).

security

• .github/workflows/update-contributor-metrics.yml:15-16 newly grants issues: read and discussions: read to GITHUB_TOKEN. Read-only and consistent with what scripts/fetch-contributor-metrics.js:333-434 queries, so this looks justified — flagged only because any newly granted workflow scope is a human sign-off per hive policy. Everything else is a tightening (--force-with-lease at line 87, github.ref == 'refs/heads/main' guard at line 79, fetch-depth 0 so the pending-branch ref exists for the retain step).

correctness

• Low — static/data/contributor-metrics.json still contains ImgBotApp (id MDQ6VXNlcjMxNDI3ODUw, one contribution 2025-07-30). It's the imgbot.net service account, which src/components/HiveFactoryDashboard.tsx:710 and src/components/reports/ReportLeaderboard.tsx:31 already treat as a bot, but scripts/lib/contributor-tracker.mjs:18-39 BOT_PATTERNS (the "canonical bot policy" this PR relies on at scripts/fetch-contributor-metrics.js:66) has no entry for it, so the headline 456 is 455 humans + 1 bot. Fix, then regenerate with --force:

    /^imgbot(app)?$/i,
    /\[bot\]$/i,
  

  (insert before the /\[bot\]$/i line in scripts/lib/contributor-tracker.mjs).

docs-currency

• Low — docs/analytics.mdx (diff hunk @65) removes the cross-link to the still-existing /factory/metrics page (src/pages/factory/metrics.tsx) and the only link in docs to the Linux Foundation Insights project page. Neither removal is mentioned in the PR body, and neither is DevStats framing. Suggest restoring after the new Sources paragraph:

  For development velocity across the factory repositories, see the [Factory metrics view](/factory/metrics).
  Upstream repository metrics for `projectbluefin/bluefin` are also tracked on [Linux Foundation Insights](https://insights.linuxfoundation.org/project/ublue-os-bluefin).
  

No findings from: intent-alignment, style.

Confidence: 3/5 (needs attention) — 1 perspective requires a human decision

— hive: agent=reviewer backend=copilot model=claude-fable-5.1 copilot=1.0.88