fix: distinguish never-scanned repos from real 0.0 OpenSSF Scorecard score (IN-1237)

[gaspergrom]

Summary

• The health_score_v2_security Tinybird pipe computed scorecardAvailable from whether a repos table row existed (rd.url != ''), not whether the OpenSSF Scorecard had actually run. Since every linked package gets a repos row during deps.dev seeding regardless of scan status, unscanned repos got scorecardAvailable=true with scorecardScore defaulting to '0', and the Insights frontend displayed "0.0/10" — indistinguishable from a repo that was genuinely scanned and scored 0.0.
• Fix: derive scorecardAvailable from rd.scorecardLastRunAt IS NOT NULL instead, and expose scorecardLastRunAt through the rd aggregation subquery so it's in scope.
• No frontend changes needed — getScorecardRow() in insights/frontend/config/health-breakdown-templates.ts already renders a no-data state when scorecardAvailable is false; it was only ever wrong because the upstream signal was wrong.
• No changes needed to the security-category weighting either — coveredWeight/rawScore already exclude scorecardAvailable=false repos from the aggregate, so Health Score v2 will stop penalizing unscanned repos as failing 0s once this pipe is deployed.

Jira: IN-1237

Deploy notes

Tinybird pipe change only — deploy health_score_v2_security.pipe to staging then production. No Insights redeploy required; it reads the pipe live.

Test plan

• Deploy pipe, wait for next scheduled copy run (COPY_SCHEDULE 5 2 * * *)
• Query health_score_v2_security_ds for a repo known to have never been Scorecard-scanned — confirm scorecardAvailable=false
• Query for a repo with a genuine 0.0 Scorecard score — confirm scorecardAvailable=true, scorecardScore='0'
• In Insights, visit that project's health breakdown page — unscanned repo's Scorecard row shows "not available", genuinely-scored-0.0 repo still shows "0.0/10"

[cursor]

PR Summary

Low Risk
Single Tinybird pipe logic change for a boolean availability flag; no auth or app code changes, with clearer behavior for aggregate health scoring.

Overview
Health Score v2 security now treats OpenSSF Scorecard as available only when a scan has actually run, not merely when a repos row exists from deps.dev seeding.

scorecardAvailable switches from (rd.url != '') to (rd.scorecardLastRunAt IS NOT NULL), and the repos aggregation subquery adds argMax(scorecardLastRunAt, updatedAt) so that field is available. Unscanned repos stop showing a false 0.0/10 and are excluded from Scorecard weight in coveredWeight/rawScore like other unavailable sub-scores; genuinely scanned 0.0 repos stay available.

Tinybird pipe deploy only—Insights already shows a no-data state when scorecardAvailable is false.

^{Reviewed by Cursor Bugbot for commit 62090bb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Corrects Scorecard availability detection so unscanned repositories are not treated as genuine zero scores.

Changes:

• Uses scorecardLastRunAt to determine availability.
• Exposes the latest scan timestamp in the repository aggregation.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.