fix: cap contributor graph file path loading

[JSONbored]

Motivation

• Evidence graph generation materialized and parsed full pull_request_files rows (including payloadJson) across many repositories, allowing an authenticated contributor to amplify resource usage and cause Worker/D1 OOMs or CPU exhaustion.
• Downstream graph construction only needs repoFullName, pullNumber, and path, so loading full payloads is unnecessary and unsafe at scale.

Description

• Add a narrow path-only type PullRequestFilePathRecord in src/types.ts and update evidence graph inputs to accept it instead of the full PullRequestFileRecord.
• Add listRepoPullRequestFilePaths in src/db/repositories.ts that selects only repoFullName, pullNumber, and path with optional pullNumbers filtering and a per-query limit, avoiding payloadJson parsing.
• Replace broad concurrent full-row loading with capped, sequential path-only loading in src/services/decision-pack.ts and src/queue/processors.ts, introducing total and per-repo caps (DECISION_PACK_MAX_PR_FILE_PATHS / CONTRIBUTOR_EVIDENCE_MAX_PR_FILE_PATHS and per-repo limits) and helper loadContributorPullRequestFilePaths to limit I/O and memory.
• Update src/services/contributor-evidence-graph.ts to build path edges from the lightweight path records and preserve existing graph semantics.

Testing

• Ran npm run typecheck which completed successfully.
• Ran npx vitest run test/unit/contributor-evidence-graph.test.ts test/unit/decision-pack.test.ts and those unit tests passed.
• An initial attempt to run a broader unit invocation including test/unit/queue.test.ts was stopped after existing queue tests exhibited unrelated timeouts/failures; the focused tests above validate the changed code paths.

---

Codex Task

[ghost]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#894 is no longer open.	No action.

---

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

❌ Patch coverage is 86.04651% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 96.69%. Comparing base (25b77f1) to head (74b4655).

Files with missing lines	Patch %	Lines
src/db/repositories.ts	71.42%	0 Missing and 2 partials ⚠️
src/queue/processors.ts	88.88%	0 Missing and 2 partials ⚠️
src/services/decision-pack.ts	88.88%	0 Missing and 2 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #894      +/-   ##
==========================================
- Coverage   96.72%   96.69%   -0.04%     
==========================================
  Files         109      109              
  Lines       14750    14789      +39     
  Branches     5340     5352      +12     
==========================================
+ Hits        14267    14300      +33     
  Misses         95       95              
- Partials      388      394       +6     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[ghost]

gittensory · advisory review

Reviewed 6 changed file(s) — two independent AI reviewers.

Changed files: src/db/repositories.ts, src/queue/processors.ts, src/services/contributor-evidence-graph.ts, src/services/decision-pack.ts, src/types.ts, test/unit/db-persistence.test.ts

Suggested action: 🛠️ Request changes. (reviewers split: request changes / merge) Address the suggestions below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
The PR introduces capped loading of PR file paths to prevent unbounded queries, adds a new PullRequestFilePathRecord type, new DB query, and updates processors, decision-pack, and evidence graph to use the capped data. The changes are well‑tested, but decision-pack.ts is missing an import for ContributorProfile, which will cause a TypeScript compilation error.

Suggestions

• Add import type { ContributorProfile } from "../signals/engine"; to src/services/decision-pack.ts.
• Run the full TypeScript type‑check after the import to ensure no other call sites still expect PullRequestFileRecord where PullRequestFilePathRecord is now required.
• Consider adding a unit test for the new listRepoPullRequestFilePaths DB function directly (e.g., verifying limit clamping) to improve coverage.

Worth double-checking

• Missing import will break the build and CI.
• If other modules still use the old PullRequestFileRecord type with the updated functions, they may encounter type errors.

Reviewer B · nemotron-3-120b-a12b — recommends ✅ merge
The PR introduces caps on file path loading for contributor evidence and decision pack generation to prevent excessive resource usage. It adds a new repository function listRepoPullRequestFilePaths that returns limited fields and enforces a per-query limit, plus helper functions in processors and decision-pack services that enforce global (2000) and per-repo (200) caps. The changes are focused, include appropriate type updates, and add a test verifying the capping behavior.

Suggestions

• Consider extracting the duplicated loadContributorPullRequestFilePaths function into a shared utility module to avoid future inconsistencies.
• Ensure the hard-coded cap constants (2000 total, 200 per repo) are documented or made configurable if tuning is anticipated.

Worth double-checking

• Duplicated helper function in processors.ts and decision-pack.ts may diverge if updated in only one place.
• Verify no other callers rely on the old listRepoPullRequestFiles behavior (though the old function remains unchanged).
• Confirm the per-query limit of 500 in the new repository function aligns with overall caps (it does, as helpers use lower limits).

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	gittensory-ui	74b4655	Commit Preview URL Branch Preview URL	Jun 19 2026, 06:02 AM