fix(gittensor): drop empty-name repos from contributor snapshot#445
Merged
JSONbored merged 2 commits intoJun 7, 2026
Merged
Conversation
|
Note Gittensory Gate skippedPR closed before full evaluation. No late first comment was created.
Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers. |
JSONbored
approved these changes
Jun 7, 2026
Owner
JSONbored
left a comment
There was a problem hiding this comment.
@philluiz2323 this is good to land.
A few notes:
- The empty-name repository guard matches the existing PR/issue filtering behavior.
- The updated test now verifies malformed repo names are dropped instead of carried into the contributor snapshot.
- This resolves #444 cleanly without changing behavior for valid repository records.
- No code changes requested.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
buildGittensorContributorSnapshot(src/gittensor/api.ts:246) filtered the snapshot's repositories list by activity only, not by a validrepoFullName-- unlike the pull-request and issue lists right beside it, which both require a non-emptyrepoFullName:#437 made
repositoryFullNamean untrustedunknownand coerces malformed/missing values to""(asString), but did not add the empty-name filter to the repositories list. So a malformed repo evaluation with nonzero stats leaks in as{ repoFullName: "", ... }. Closes #444.Observable impact
snapshot.repositoriesfeedsbuildGittensorContributorProfile(src/signals/engine.ts):reposTouched(engine.ts:1119) keeps the empty-name repo (nonzero stats), so it leaks intoregisteredRepoActivity.reposTouchedas"".evidenceScore = clamp(... + reposTouched.length * 10 + ..., 0, 100)(engine.ts:1137): one phantom repo adds +10 on a 0-100 scale, which can bumptrustSignals.levela tier (new< 25,emerging25-59,established>= 60).Reachable because #437 itself treats upstream Gittensor repository names as untrusted JSON that can be malformed.
Scope
src/gittensor/api.ts-- addrepo.repoFullName &&to the repositories filter, matching the PR/issue lists and fix(gittensor): guard Gittensor repo name normalization #437's intent.test/unit/gittensor-api.test.ts-- the fix(gittensor): guard Gittensor repo name normalization #437 malformed-payload test asserted the empty-name repo was included; updated to assert it is dropped (repositories is["owner/repo"]only) with an explicit no-leak check.Validation
npx tsc --noEmit-- clean.npx vitest run test/unit/gittensor-api.test.ts-- 8/8.mcp-clitimeout that passes in isolation).Safety
""-named repositories.