Merge branch 'main' into chore/scorecard-coverage-in-1251

Author: joanagmaia

services/libs/tinybird/datasources/health_score_v2_repo_copy_ds.datasource

@@ -12,7 +12,7 @@ DESCRIPTION >
     dependency health (checked against the repo's own published packages' dependencies, not an average
     across unrelated packages), supply chain integrity (hardcoded 0 — provenance/2FA data not yet piped).
     - `developmentActivityScoreV2` (0-25) — release cadence, commit activity, issue resolution, PR merge health.
-    - `healthScoreV2` (0-100) is the sum of the three categories above, clamped to 100.
+    - `healthScoreV2` (0-100) — weighted rescale of available categories: SUM(available subtotals) * (100 / SUM(available weights)), clamped to 100. NULL when fewer than 2 of the 3 categories are available. Does not equal the arithmetic sum of the three subtotals.
     - `lifecycleLabelV2` — per-repo lifecycle state (active/stable/declining/inert/abandoned/archived),
     computed via the spec's decision tree (archived flag > abandoned > inert > declining > stable >
     active, first match wins), or NULL when the repo has zero commits and zero issues/PRs in every window
@@ -23,8 +23,9 @@ DESCRIPTION >
     - Graceful degradation (spec Layer 1+2): per-category pipes emit NULL when covered sub-signal weight
     is <40% of that category's max pts (Layer 1); the aggregate health_score_v2 applies Layer 2 rescaling
     (`SUM(available categories) * (100 / SUM(available category weights))`) so only actually-available
-    scores are summed. If all three categories are unavailable, healthScoreV2 itself is NULL (see
-    health_score_v2.pipe DESCRIPTION for the full spec).
+    scores are summed. healthScoreV2 is NULL when fewer than 2 of the 3 categories are available —
+    a single-category rescale would extrapolate ≤40 pts of evidence into a full 0-100 range (IN-1248).
+    See health_score_v2.pipe DESCRIPTION for the full spec.
     - Known temporary gap: security-practices score's spec-stated max is 8 points (includes +1 for
     `security_contact_email IS NOT NULL` flag), but no `security_contact_email` column exists yet in
     the GitHub enrichment datasource, so the current maximum achievable is 7 points. This gap is

services/libs/tinybird/pipes/health_score_v2.pipe

@@ -13,8 +13,9 @@ DESCRIPTION >
     - Applies spec Layer 2 graceful degradation across categories: healthScoreV2 = SUM(available
     category subtotals) * (100 / SUM(available category max weights)) — each category datasource
     already carries NULL when its own coverage fell below 40% (Layer 1, done per-category pipe).
-    If all three categories are unavailable, healthScoreV2 itself becomes NULL, per spec, rather
-    than a fabricated 0. Impact stays NULL (not defaulted to 0) when the repo has no packages.
+    If fewer than 2 of the 3 categories are available, healthScoreV2 becomes NULL rather than
+    rescaling a single-category score into a misleading full 0-100 range (IN-1248). Impact stays
+    NULL (not defaulted to 0) when the repo has no packages.
     - lifecycleLabelV2 passes through health_score_v2_lifecycle_ds unmodified (2026-07-24,
     IN-1196) — previously wrapped in `coalesce(l.lifecycleLabelV2, 'active')`, which silently
     converted the upstream pipe's genuine "no usable signal" NULL back into a fabricated 'active'
@@ -31,7 +32,7 @@ SQL >
         securitySupplyChainScoreV2,
         developmentActivityScoreV2,
         if(
-            coveredCategoryWeight = 0,
+            coveredCategoryCount < 2,
             NULL,
             toNullable(
                 toUInt8(round(least(100.0, availableCategorySum * (100.0 / coveredCategoryWeight))))
@@ -59,6 +60,11 @@ SQL >
                     + if(s.securitySupplyChainScoreV2 IS NOT NULL, 35, 0)
                     + if(d.developmentActivityScoreV2 IS NOT NULL, 25, 0)
                 ) AS coveredCategoryWeight,
+                (
+                    if(m.maintainerHealthScoreV2 IS NOT NULL, 1, 0)
+                    + if(s.securitySupplyChainScoreV2 IS NOT NULL, 1, 0)
+                    + if(d.developmentActivityScoreV2 IS NOT NULL, 1, 0)
+                ) AS coveredCategoryCount,
                 l.lifecycleLabelV2 AS lifecycleLabelV2,
                 i.impactScoreRaw AS impactScoreRaw
             FROM