chore: reallocate blocked supply-chain-integrity 5 pts into security signals (IN-1250)

Signed-off-by: Joana Maia <jmaia@contractor.linuxfoundation.org>

Author: joanagmaia

services/libs/tinybird/datasources/health_score_v2_security_ds.datasource

@@ -5,7 +5,8 @@ DESCRIPTION >
     - `securitySupplyChainScoreV2` — NULL when covered sub-signal weight is <40% of the 35pt max
     (spec Layer 1 graceful degradation), otherwise the rescaled 0-35 score.
     - `openVulnScore`/`scorecardScorePts`/`securityPracticesScore`/`dependencyHealthScore` (IN-1212)
-    are the raw per-signal sub-scores before rescaling, as computed in `health_score_v2_security.pipe`.
+    are the raw per-signal sub-scores before rescaling (openVuln 0-10, scorecard 0-7, practices 0-7,
+    deps 0-5); scaled to the new weights (12/8/8/7) inside rawScore in the pipe (IN-1250).
     - `scorecardAvailable`/`securityPracticesAvailable`/`dependencyHealthAvailable` (IN-1212) and
     `openVulnAvailable` (IN-1241) are the Layer 1 coverage flags — 0 means the signal was `blocked`
     (no data), not scored 0. `openVulnAvailable` is 0 when the repo has never completed a

services/libs/tinybird/pipes/health_score_v2_security.pipe

@@ -1,21 +1,23 @@
 DESCRIPTION >
-    Security & Supply Chain category (max 35 pts): open vulnerabilities (10, blocked when the repo
+    Security & Supply Chain category (max 35 pts): open vulnerabilities (12, blocked when the repo
     has never completed a vulnerability scan — see vulnerability_scans — so "0 open vulns" isn't
-    conflated with "never scanned"), OpenSSF Scorecard (7,
+    conflated with "never scanned"), OpenSSF Scorecard (8,
     blocked for repos with no repos-table row — effectively non-GitHub hosts), security practices
-    (spec max 8, but capped here at 7 achievable — the spec's 6th bullet, security_contact_email,
-    has no corresponding column anywhere in our GitHub enrichment data, so it's permanently omitted
-    like Supply Chain Integrity below; blocked entirely when repos-table row missing), dependency
-    health (5, blocked when the repo has no published packages so vulnerability exposure is unknown),
-    supply chain integrity (5, permanently blocked — hardcoded per spec, provenance/2FA data not yet
-    in the pipeline). Graceful degradation (spec Layer 1+2): category_subtotal =
+    (8, blocked when repos-table row is missing; security_contact_email has no column in GitHub
+    enrichment data so the sub-score is capped at 7 internally, scaled to 8 at aggregation),
+    dependency health (7, blocked when the repo has no published packages so vulnerability exposure
+    is unknown). Graceful degradation (spec Layer 1+2): category_subtotal =
     SUM(available_sub_scores) * (35 / SUM(available_sub_max_weights)); category is `unavailable`
     (NULL) when covered weight is <40% of 35.
     - Split out of health_score_v2.pipe into its own copy pipe (2026-07-22) — see
     health_score_v2_maintainer.pipe description for why.
     - Scorecard banded mapping (2026-08-27, IN-1247): raw ≥ 7 → 7 pts, ≥ 5.5 → 5, ≥ 4 → 4,
     ≥ 2.5 → 2, else 0. Replaces the linear round(min(raw,10)×0.7) which required raw ≥ 9.3 for
     full points (only 0.33% of repos), calibrated to real distribution (median ≈ 4, p99 ≈ 7.9).
+    - Supply-chain-integrity reallocation (2026-08-28, IN-1250): the permanently-blocked 5 pts were
+    folded proportionally into the four available signals (×35/29 each, rounded to integers), so the
+    covered-weight maximum equals the category maximum (35) and the rescale factor is 1.0 for
+    fully-covered repos. Category max and Layer 2 weight unchanged.
 
 NODE health_score_v2_security_calc
 SQL >
@@ -68,16 +70,16 @@ SQL >
                 dependencyHealthAvailable,
                 vulnerableDeps,
                 (
-                    openVulnAvailable * openVulnScore
-                    + scorecardAvailable * scorecardScorePts
-                    + securityPracticesAvailable * securityPracticesScore
-                    + dependencyHealthAvailable * dependencyHealthScore
+                    openVulnAvailable * openVulnScore * 1.2
+                    + scorecardAvailable * scorecardScorePts * 8.0 / 7
+                    + securityPracticesAvailable * securityPracticesScore * 8.0 / 7
+                    + dependencyHealthAvailable * dependencyHealthScore * 1.4
                 ) AS rawScore,
                 (
-                    openVulnAvailable * 10
-                    + scorecardAvailable * 7
-                    + securityPracticesAvailable * 7
-                    + dependencyHealthAvailable * 5
+                    openVulnAvailable * 12
+                    + scorecardAvailable * 8
+                    + securityPracticesAvailable * 8
+                    + dependencyHealthAvailable * 7
                 ) AS coveredWeight
             FROM
                 (