Skip to content

fix: deterministic package repo tie-break #4263

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
epipav merged 6 commits into from
Aug 6, 2026
Merged

fix: deterministic package repo tie-break #4263

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
6 commits
Select commit Hold shift + click to select a range
341314e
fix: deterministic package repo tie-break
epipav Jun 25, 2026
90d64d5
Merge branch 'main' into fix/package-repo-tiebreak
epipav Jun 25, 2026
ecab2d3
style: format pkg repo pipe node
epipav Jun 25, 2026
36218ca
Merge remote-tracking branch 'origin/main' into fix/package-repo-tieb…
epipav Aug 6, 2026
d35564e
Merge remote-tracking branch 'origin/main' into fix/package-repo-tieb…
epipav Aug 6, 2026
dc22458
fix: align repo tie-break ordering across all package repo picks
epipav Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion services/apps/packages_worker/src/security-contacts/ingestSingle.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,7 +53,7 @@ async function findBestRepoForPurl(qx: QueryExecutor, purl: string): Promise<Sin
SELECT pr.repo_id
FROM package_repos pr
WHERE pr.package_id = p.id
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC, pr.repo_id DESC
LIMIT 1
) best ON true
JOIN repos r ON r.id = best.repo_id
Expand Down
10 changes: 5 additions & 5 deletions services/libs/data-access-layer/src/osspckgs/api.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -340,7 +340,7 @@ export async function getPackageStatusCounts(
FROM package_repos pr
JOIN repos r ON r.id = pr.repo_id
WHERE pr.package_id = p.id
ORDER BY pr.confidence DESC
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC, pr.repo_id DESC
LIMIT 1
) r_sc ON true
${where}
Expand Down Expand Up @@ -521,7 +521,7 @@ export async function listPackagesForApi(
FROM package_repos pr
JOIN repos r ON r.id = pr.repo_id
WHERE pr.package_id = p.id
ORDER BY pr.confidence DESC
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC, pr.repo_id DESC
LIMIT 1
) r_sc ON true`

Expand Down Expand Up @@ -976,7 +976,7 @@ export async function listPackagesForScatter(
FROM package_repos pr
JOIN repos r ON r.id = pr.repo_id
WHERE pr.package_id = p.id
ORDER BY pr.confidence DESC
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC, pr.repo_id DESC
LIMIT 1
) r_sc ON true
WHERE p.is_critical = true
Expand Down Expand Up @@ -1203,7 +1203,7 @@ export async function getReportingProtocolByPurl(
SELECT pr2.repo_id
FROM package_repos pr2
WHERE pr2.package_id = p.id
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC, pr2.repo_id DESC
LIMIT 1
) pr ON true
JOIN repo_reporting_protocols rp ON rp.repo_id = pr.repo_id
Expand Down Expand Up @@ -1235,7 +1235,7 @@ export async function getReportingProtocolsByPurls(
SELECT pr2.repo_id
FROM package_repos pr2
WHERE pr2.package_id = p.id
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC, pr2.repo_id DESC
LIMIT 1
) pr ON true
JOIN repo_reporting_protocols rp ON rp.repo_id = pr.repo_id
Expand Down
2 changes: 1 addition & 1 deletion services/libs/data-access-layer/src/osspckgs/sqlFragments.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ export const BEST_REPO_LINK_JOIN = `LEFT JOIN LATERAL (
SELECT pr2.repo_id, pr2.confidence
FROM package_repos pr2
WHERE pr2.package_id = p.id
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC
ORDER BY pr2.confidence DESC, (pr2.source = 'declared') DESC, pr2.repo_id DESC
LIMIT 1
) pr ON true
LEFT JOIN repos r ON r.id = pr.repo_id`
Expand Down
2 changes: 1 addition & 1 deletion services/libs/data-access-layer/src/osspckgs/stewardships.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -629,7 +629,7 @@ export async function listMyPackages(
FROM package_repos pr
JOIN repos r ON r.id = pr.repo_id
WHERE pr.package_id = p.id
ORDER BY pr.confidence DESC
ORDER BY pr.confidence DESC, (pr.source = 'declared') DESC, pr.repo_id DESC
LIMIT 1
) r_sc ON true
LEFT JOIN LATERAL (
Expand Down
5 changes: 4 additions & 1 deletion services/libs/tinybird/pipes/ossPackages_enriched.pipe
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,10 @@ SQL >

NODE ossPackages_enriched_pkg_repo
SQL >
SELECT packageId, argMax(repoId, (toFloat64OrZero(confidence), verifiedAt)) AS repoId, 1 AS hasRepo
SELECT
packageId,
argMax(repoId, (toFloat64OrZero(confidence), verifiedAt, repoId)) AS repoId,
1 AS hasRepo
FROM packageRepos FINAL
GROUP BY packageId

Expand Down
Loading