refactor(metricsai)!: rename github_authors -> security_github_authors (#45)

Rename the security author setting and its env var (github_authors /
METRICSAI_GITHUB_AUTHORS) to security_github_authors /
METRICSAI_SECURITY_GITHUB_AUTHORS, parallel to testing_github_authors.

The testing module never inherited github_authors (testing_authors falls back
to its own classifier-bot default, not to github_authors), so the old name
misleadingly implied a shared setting. github_repos / github_token /
github_base_url keep the github_* prefix since they are genuinely shared.

The --author CLI flag and --all-authors behavior are unchanged for users; only
the env var / internal field name changed.

Also removes metricsai/src/t, a stray file accidentally committed during the
all-authors PR.

BREAKING CHANGE: METRICSAI_GITHUB_AUTHORS is now METRICSAI_SECURITY_GITHUB_AUTHORS.

Co-authored-by: Brian Hodges <bhodges@navapbc.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: 3 people

metricsai/CLAUDE.md

@@ -62,7 +62,7 @@ Conventional-Comment label (`security` vs `compliance`), plus one AWS Security H
   `match_all_authors`; when set, `_classify` skips the author-allowlist check (window + label
   gates still apply). Security-only — the `testing` module intentionally does not pass it, so
   it always keys off the classifier-bot author. `cli.main` warns if a non-default
-  `github_authors` is set alongside it.
+  `security_github_authors` is set alongside it.
 
 **`testing` module** emits the `testing_classifier_*` columns from one scan of the AI
 test-classifier's PR comments (`fetch_classifier_comments` in `sources/github.py`): comments
@@ -94,7 +94,7 @@ paths.
 
 - Pydantic v2 models/settings; extensive type hints; reStructuredText (`:param:`) docstrings;
   ruff + black at line length 100. Python `>=3.12`.
-- `github_repos` / `github_authors` settings are stored as comma-separated **strings** (to
+- `github_repos` / `security_github_authors` settings are stored as comma-separated **strings** (to
   avoid pydantic JSON-list env parsing); read them via `Settings.repos` / `.authors` or
   `config.csv_list`.
 - `tmp/` is gitignored scratch holding the original shell scripts the `security` module was

metricsai/QUICKSTART.md

@@ -44,7 +44,7 @@ All modules run by default; `--module` (repeatable) narrows. Row key = `week_end
 | `--url` | `METRICSAI_WEBHOOK_URL` | Apps Script `/exec` endpoint |
 | `--tab` | `METRICSAI_WEBHOOK_TAB` | destination sheet tab |
 | `--repo` (repeat) | `METRICSAI_GITHUB_REPOS` (csv) | repos to scan (required by `security`) |
-| `--author` (repeat) | `METRICSAI_GITHUB_AUTHORS` (csv) | AI comment authors (default `github-copilot[bot]`) |
+| `--author` (repeat) | `METRICSAI_SECURITY_GITHUB_AUTHORS` (csv) | security AI comment authors (default `github-copilot[bot]`) |
 | `--all-authors` | `METRICSAI_ALL_AUTHORS` | security: count comments from any author (ignore the allowlist) |
 | `--github-url` | `METRICSAI_GITHUB_BASE_URL` | Enterprise: `https://<host>/api/v3` |
 | `--week-ending-day` | `METRICSAI_WEEK_ENDING_DAY` | week-closing weekday (default `friday`) |

metricsai/README.md

@@ -134,7 +134,7 @@ All settings use the `METRICSAI_` prefix.
 | `METRICSAI_GITHUB_KEYCHAIN_SERVICE` | `metricsai-github`   | Keychain service name for the GitHub token.                                 |
 | `METRICSAI_GITHUB_BASE_URL`         | `https://api.github.com` | GitHub REST base URL. For Enterprise use `https://<host>/api/v3`. (`--github-url`) |
 | `METRICSAI_GITHUB_REPOS`            | _(none)_             | Comma-separated `owner/repo` list to scan. Required by `security`. (`--repo`) |
-| `METRICSAI_GITHUB_AUTHORS`          | `github-copilot[bot]` | Comma-separated comment authors counted as AI-generated. (`--author`)      |
+| `METRICSAI_SECURITY_GITHUB_AUTHORS` | `github-copilot[bot]` | Comma-separated authors the `security` module counts as AI-generated. (`--author`) |
 | `METRICSAI_ALL_AUTHORS`             | `false`              | Security scan counts comments from any author, ignoring the author allowlist. `--all-authors` |
 | `METRICSAI_WEEK_ENDING_DAY`         | `friday`             | Weekday the reporting week closes on (name or abbrev). `--week-ending-day`   |
 | `METRICSAI_AWS_REGION`              | _(boto3 default)_    | AWS region for Security Hub. Falls back to `AWS_REGION` / active profile.   |
@@ -240,7 +240,7 @@ The same token is used for github.com and GitHub Enterprise (set `--github-url`
 
 A comment is counted only if **all three** hold — so a manual test often shows zeros:
 
-1. **Author** is in `--author` / `METRICSAI_GITHUB_AUTHORS` (default `github-copilot[bot]`).
+1. **Author** is in `--author` / `METRICSAI_SECURITY_GITHUB_AUTHORS` (default `github-copilot[bot]`).
    Comments you wrote yourself won't count unless you add your own login — or pass
    `--all-authors` / `METRICSAI_ALL_AUTHORS=true` to count comments from *any* author.
 2. **Created within the window** — the 7 days ending on `week_ending_date`. Comments from

metricsai/docs/usage.md

@@ -35,7 +35,7 @@ All settings use the `METRICSAI_` prefix and may be set in the environment.
 | `METRICSAI_GITHUB_KEYCHAIN_SERVICE` | `metricsai-github`       | Keychain service name for the GitHub token.                         |
 | `METRICSAI_GITHUB_BASE_URL`         | `https://api.github.com` | GitHub REST base URL (Enterprise: `https://<host>/api/v3`). `--github-url` |
 | `METRICSAI_GITHUB_REPOS`            | _(none)_                 | Comma-separated `owner/repo` list. Required by `security`. `--repo` |
-| `METRICSAI_GITHUB_AUTHORS`          | `github-copilot[bot]`    | Comma-separated AI comment authors. `--author`                      |
+| `METRICSAI_SECURITY_GITHUB_AUTHORS` | `github-copilot[bot]`    | Comma-separated AI comment authors (security module). `--author`    |
 | `METRICSAI_ALL_AUTHORS`             | `false`                  | Security scan counts comments from any author, ignoring the author allowlist. `--all-authors` |
 | `METRICSAI_WEEK_ENDING_DAY`         | `friday`                 | Weekday the reporting week closes on. `--week-ending-day`           |
 | `METRICSAI_AWS_REGION`              | _(boto3 default)_        | AWS region for Security Hub.                                        |

metricsai/src/metricsai/cli.py

@@ -54,7 +54,7 @@ def _apply_overrides(settings: Settings, args: argparse.Namespace) -> Settings:
     if args.repo:
         overrides["github_repos"] = ",".join(args.repo)
     if args.author:
-        overrides["github_authors"] = ",".join(args.author)
+        overrides["security_github_authors"] = ",".join(args.author)
     if args.all_authors:
         overrides["all_authors"] = True
     if args.week_ending_day:
@@ -114,13 +114,13 @@ def build_parser() -> argparse.ArgumentParser:
         action="append",
         metavar="LOGIN",
         help="Comment author to count as AI-generated (repeatable; overrides "
-        "METRICSAI_GITHUB_AUTHORS).",
+        "METRICSAI_SECURITY_GITHUB_AUTHORS).",
     )
     parser.add_argument(
         "--all-authors",
         action="store_true",
         help="Count security-reviewer comments from any author, ignoring the --author / "
-        "METRICSAI_GITHUB_AUTHORS allowlist (overrides METRICSAI_ALL_AUTHORS).",
+        "METRICSAI_SECURITY_GITHUB_AUTHORS allowlist (overrides METRICSAI_ALL_AUTHORS).",
     )
     parser.add_argument(
         "--skip-sechub",
@@ -199,11 +199,11 @@ def main(argv: list[str] | None = None) -> int:
         return _store_secret(settings.webhook_keychain_service, "Enter webhook API key: ")
 
     settings = _apply_overrides(settings, args)
-    if settings.all_authors and settings.github_authors not in ("", DEFAULT_AUTHOR):
+    if settings.all_authors and settings.security_github_authors not in ("", DEFAULT_AUTHOR):
         logger.warning(
             "--all-authors / METRICSAI_ALL_AUTHORS is set, so the configured comment "
             "authors (%s) are ignored for the security scan.",
-            settings.github_authors,
+            settings.security_github_authors,
         )
     webhook_url = args.url or (str(settings.webhook_url) if settings.webhook_url else None)
     try:

metricsai/src/metricsai/config.py

@@ -32,7 +32,7 @@ def csv_list(value: str | None) -> list[str]:
 class Settings(BaseSettings):
     """Environment-backed configuration.
 
-    Comma-separated fields (``github_repos``, ``github_authors``) are kept as raw strings
+    Comma-separated fields (``github_repos``, ``security_github_authors``) are kept as raw strings
     here and split with :func:`csv_list` at the point of use; this keeps environment
     parsing simple and avoids JSON-list quoting.
 
@@ -53,13 +53,15 @@ class Settings(BaseSettings):
         ``https://<host>/api/v3`` for GitHub Enterprise.
     :ivar github_repos: Comma-separated ``owner/repo`` list to scan. Required for the
         security module (overridable with ``--repo``).
-    :ivar github_authors: Comma-separated comment author logins to count as AI-generated.
+    :ivar security_github_authors: Comma-separated comment author logins counted as
+        AI-generated by the ``security`` module. The ``testing`` module does not inherit
+        this; it has its own ``testing_github_authors``.
     :ivar testing_github_repos: Comma-separated ``owner/repo`` list the ``testing`` module
         scans for classifier comments. Falls back to ``github_repos`` when unset.
     :ivar testing_github_authors: Comma-separated author logins of the test-classifier's
         comments. Falls back to the classifier-bot default when unset.
     :ivar all_authors: When ``True``, the ``security`` module counts comments from *any*
-        author and ignores the ``github_authors`` allowlist entirely (the window and
+        author and ignores the ``security_github_authors`` allowlist entirely (the window and
         Conventional-Comment label gates still apply). Does not affect the ``testing``
         module, which only counts the test-classifier's own structured comments. Off by
         default.
@@ -83,7 +85,7 @@ class Settings(BaseSettings):
     github_keychain_service: str = "metricsai-github"
     github_base_url: str = "https://api.github.com"
     github_repos: str = ""
-    github_authors: str = DEFAULT_AUTHOR
+    security_github_authors: str = DEFAULT_AUTHOR
     testing_github_repos: str = ""
     testing_github_authors: str = ""
     all_authors: bool = False
@@ -100,7 +102,7 @@ def repos(self) -> list[str]:
     @property
     def authors(self) -> list[str]:
         """Comment authors to count, falling back to the default bot."""
-        return csv_list(self.github_authors) or [DEFAULT_AUTHOR]
+        return csv_list(self.security_github_authors) or [DEFAULT_AUTHOR]
 
     @property
     def testing_repos(self) -> list[str]:

metricsai/src/t

@@ -22,7 +22,7 @@ def _clear_env(monkeypatch: pytest.MonkeyPatch) -> None:
         "METRICSAI_WEBHOOK_TAB",
         "METRICSAI_GITHUB_TOKEN",
         "METRICSAI_GITHUB_REPOS",
-        "METRICSAI_GITHUB_AUTHORS",
+        "METRICSAI_SECURITY_GITHUB_AUTHORS",
         "METRICSAI_GITHUB_BASE_URL",
         "METRICSAI_WEEK_ENDING_DAY",
         "METRICSAI_AWS_REGION",