dennisdoomen / packageguard / 32656324840

81%

push

github

Cut the GitHub requests a repository costs (#240)

* Cut the GitHub requests a repository costs

Collecting risk signals for one repository could take over 150 requests. Most
of them came from three fan-outs that spend a request per item: the comments of
every open bug issue, the timeline of twenty closed ones, and the reviews of
twenty pull requests.

With a token configured, one GraphQL query now returns all of that. GitHub
rejects unauthenticated GraphQL requests, so the REST path stays as the
fallback, with the fan-outs capped at a sample of twenty. A median over twenty
issues says the same thing as one over a hundred.

Four more requests were being spent for nothing:

- the closed pull requests were listed twice, once with a page size of 100 for
  the merge-time metric and once with 30 for the review metrics. The larger
  response is a superset, so one listing feeds both.
- .github/SECURITY.md was probed even when the root listing showed no .github
  directory. A 404 costs the same as a hit.
- .github/dependabot.yml was read even when the workflows already proved that
  dependency updates are automated, which the signal ORs together anyway.
- every workflow file was downloaded, though the signals read from them are
  keyword matches that saturate after a handful.

Responses are now also shared for the length of a run: asking for a URL a
second time replays the body already received. That makes the repository
lookups of packages from one repository cost a single request, and lets license
resolution read the repository resource that risk enrichment needs as well,
instead of the separate license endpoint.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* Stop the live GitHub tests from failing on a spent rate limit

Two tests that read live repository data failed together, in a few hundred
milliseconds each, with the GitHub signals missing. That is what a spent rate
limit budget looks like now: the client merged in #239 stops making requests... (continued)

1872 of 2616 branches covered (71.56%)

Branch coverage included in aggregate %.

359 of 407 new or added lines in 7 files covered. (88.21%)

5882 of 7082 relevant lines covered (83.06%)

1764.19 hits per line