chore: reallocate blocked supply-chain-integrity 5 pts into security signals (IN-1250)

[joanagmaia]

Summary

• Supply-chain-integrity (5 pts) is permanently unavailable; its weight was silently redistributed via the 35/coveredWeight rescale factor, giving remaining signals ~21% more relative weight than the methodology stated
• Folds the 5 pts proportionally into the four available signals: openVuln 10→12, scorecard 7→8, practices 7→8, deps 5→7 (sum = 35)
• coveredWeight max now equals the category max (35), so the rescale factor is 1.0 for fully-covered repos — no silent redistribution
• Category max (35) and Layer 2 aggregate weight unchanged; health_score_v2.pipe untouched
• ossPackages_enriched.pipe:240 (0 AS supplyChainIntegrity, additive formula, no redistribution) left as separate cleanup

Notes

• Sub-score formulas unchanged; scaling applied at aggregation (rawScore) so stored sub-score fields retain original ranges
• methodologyVersion stays '2.0.0' — still iterating on v2

🤖 Generated with Claude Code

[cursor]

PR Summary

Medium Risk
Changes how security category points are computed and rescale behavior for all repos with partial or full security coverage, which will shift published Health Score v2 values without a methodology version bump.

Overview
Health Score v2 security no longer relies on the 35/coveredWeight rescale to implicitly boost signals when supply-chain integrity is permanently blocked. The unavailable 5 pt supply-chain slot (and one nominal practices point that was unachievable without security_contact_email) is explicitly folded into the four live signals: 12/8/8/7 for open vulns, scorecard, practices, and dependency health.

Aggregation in health_score_v2_security.pipe applies the new caps via coveredWeight (max 35 when all signals are available) and per-signal scaling in rawScore (×1.2, ×8/7, ×1.4), while stored sub-score fields keep their original formula ranges. Category total (35) and Layer 2 weight in health_score_v2.pipe are unchanged; datasource descriptions are updated to match.

^{Reviewed by Cursor Bugbot for commit 1facbf7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Reallocates the unavailable supply-chain-integrity weight across existing security signals while preserving the 35-point category maximum.

Changes:

• Updates aggregation weights to 12/8/8/7.
• Documents retained raw sub-score ranges and aggregation scaling.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
health_score_v2_security.pipe	Applies the revised scoring weights.
health_score_v2_security_ds.datasource	Documents raw ranges and scaling.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Suppressed comments (1)

services/libs/tinybird/pipes/health_score_v2_security.pipe:8

• The documented aggregation formula is now inaccurate. The exposed sub-scores still total at most 29, while rawScore first normalizes them to the new 12/8/8/7 weights and can total 35. Please state that the sum contains weighted/normalized contributions; otherwise this description cannot be used to reconstruct the implemented score.

    (8, blocked when repos-table row is missing; security_contact_email has no column in GitHub
    enrichment data so the sub-score is capped at 7 internally, scaled to 8 at aggregation),
    dependency health (7, blocked when the repo has no published packages so vulnerability exposure

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

services/libs/tinybird/pipes/health_score_v2_security.pipe:83

• The PR description still says the 5 points are folded “proportionally,” but these weights are a deliberate integer allocation rather than a proportional one: scaling 10/7/7/5 by 35/29 gives approximately 12.07/8.45/8.45/6.03, not 12/8/8/7. Please either update the PR description to match the clarified pipe note or use proportional weights.

                    openVulnAvailable * 12
                    + scorecardAvailable * 8
                    + securityPracticesAvailable * 8
                    + dependencyHealthAvailable * 7

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

Suppressed comments (1)

services/libs/tinybird/pipes/health_score_v2_security.pipe:22

• The implementation and this note allocate six active points: five from supply-chain integrity plus the restored practices point. That conflicts with the PR description’s claim that only five points are folded “proportionally” into 12/8/8/7; those increments are not proportional. Update the PR description to match the allocation documented here.

    - Supply-chain-integrity reallocation (2026-08-28, IN-1250): coveredWeight raised from 29 to 35
    (+6 total: 5 from the permanently-blocked supply-chain slot + 1 restoring the practices signal's
    nominal 8th pt, always in spec but unachievable due to missing security_contact_email column,
    now recovered via `* 8.0/7` scaling) distributed as openVuln +2, scorecard +1, practices +1
    (via 8.0/7), deps +2 → 12/8/8/7. Rescale factor is now 1.0 for fully-covered repos. Category