feat: resolve rubygems owner handles via github contributor verification [CM-1341]

[mbani01]

This pull request enhances the security contacts extraction process by introducing a mechanism to identify and verify registry usernames that might correspond to GitHub handles, but require corroboration before being accepted as valid contacts. The changes mainly add support for handling such "handle candidates" (especially for RubyGems), collecting them during extraction, and confirming their association with a repository via contributor checks before inclusion.

New candidate handle extraction and verification:

• Added a new function mapRubygemsOwnerHandles in rubygems.ts to extract possible GitHub handles from RubyGems owners, marking them as candidates that require further verification.
• Updated the RubyGems fetcher (fetchRubygems) to return both direct contacts and these handle candidates.
• Updated the extractor interface and result type (ExtractorResult in types.ts) to include an optional handleCandidates field.
• Modified the main manifest extraction logic (extractManifest in index.ts) to collect and deduplicate handle candidates from all fetchers. [1] [2] [3]

Handle candidate verification and integration:

• Introduced a new module, verifyHandleCandidates.ts, which verifies candidate handles by checking if they are the repo owner or a top-100 contributor, only accepting corroborated handles as contacts.
• Updated processBatch.ts to collect all handle candidates from extractors, verify them using the new function, and only then add them to the final contacts list. [1] [2] [3]

These changes improve the accuracy and reliability of GitHub handle extraction from package registries, reducing the risk of false positives.

[cursor]

PR Summary

Medium Risk
Adds GitHub API contributor lookups during contact enrichment and changes which handles become persisted contacts, which can affect outreach accuracy and API usage.

Overview
Introduces a handle candidate path so registry usernames that might be GitHub logins are not written as contacts until they are corroborated against the linked repo.

RubyGems owners without email now emit github-handle candidates via mapRubygemsOwnerHandles; manifest extraction deduplicates candidates across packages and returns them on ExtractorResult. verifyHandleCandidates promotes a candidate only when the handle matches the repo owner or appears in the top-100 contributors (one extra GitHub API call per repo with candidates); provenance records github-contributors or github-repo-owner. Verified handles are merged in processRepo before noreply derivation and CDP email resolution.

^{Reviewed by Cursor Bugbot for commit 5fdec8e. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 31ad2eb. Configure here.}

[Copilot]

Pull request overview

Adds verified RubyGems owner handles to the security-contact extraction pipeline.

Changes:

• Extracts and deduplicates RubyGems handle candidates.
• Verifies candidates against repository ownership and contributors.
• Integrates verified handles into contact reconciliation and email resolution.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
verifyHandleCandidates.ts	Verifies candidate GitHub handles.
types.ts	Extends extractor results with handle candidates.
processBatch.ts	Integrates candidate verification.
rubygems.ts	Extracts RubyGems owner handles.
registry/index.ts	Aggregates candidate handles across packages.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

services/apps/packages_worker/src/security-contacts/verifyHandleCandidates.ts:51

• A contributor lookup failure also drops candidates whose handle already matches the repository owner, although that match is independently corroborated by target.url. GitHub can transiently return 202/rate-limit errors here, so preserve owner matches and only fall back from contributor verification.

    return []