fix: exclude archived repos from vulnerability data in Tinybird pipes (IN-1186)

[joanagmaia]

Summary

• Vulnerabilities from archived repositories were being surfaced on the Insights Security page, leading to misleading CVE reports for repos that are no longer actively maintained
• Adds archived = false / archived != true filters to the 4 vulnerability endpoint pipes and the 2 COPY pipes that aggregate vulnerability data
• segments_filtered.pipe is intentionally untouched — the filter is applied surgically only to vulnerability queries so other metrics (commits, stars, contributors, etc.) still include archived repos

Pipes changed

Pipe	Change
vulnerabilities_list.pipe	Filter added to both the count and listing branches
vulnerabilities_by_ecosystem.pipe	Filter added
vulnerabilities_by_severity.pipe	Filter added
vulnerabilities_summary.pipe	Filter added
insights_projects_populated_copy.pipe	last_vulnerability_scan_status node excludes archived repos (drives lastVulnerabilityScanStatus on the project card)
agentic_ai_projects_list_copy.pipe	vulnerability_counts node filters r.archived = false on the existing repositories join

References

• [Report issue] bootc  insights#1948
• [Report issue] Cilium  insights#1968
• IN-1186

---

Note

Medium Risk
Changes only read-side SQL filters on security-facing metrics, but they alter reported vulnerability counts and scan status for projects with archived repos, which could surprise users until COPY/API data refreshes.

Overview
Stops Insights Security and related dashboards from counting CVEs tied to archived repositories by filtering those repos out of vulnerability queries only.

The four API pipes (vulnerabilities_list, vulnerabilities_by_ecosystem, vulnerabilities_by_severity, vulnerabilities_summary) now add v.repoUrl NOT IN (SELECT url FROM repositories FINAL WHERE archived = true) alongside the existing segment/repo filters; the list pipe applies this in both the count and listing branches. COPY jobs are updated in parallel: insights_projects_populated_copy excludes archived repos when deriving lastVulnerabilityScanStatus, and agentic_ai_projects_list_copy requires r.archived = false on the repositories join in vulnerability_counts.

segments_filtered is unchanged so commits, stars, contributors, and other non-security metrics still include archived repos.

^{Reviewed by Cursor Bugbot for commit b394829. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR updates Tinybird vulnerability-related pipes to stop surfacing CVE/vulnerability data (and derived scan status) for repositories marked as archived, so Insights Security views don’t report misleading vulnerability posture for inactive repos.

Changes:

• Added an “exclude archived repositories” filter to all four vulnerability endpoint pipes (vulnerabilities_list, vulnerabilities_summary, vulnerabilities_by_severity, vulnerabilities_by_ecosystem).
• Updated two COPY aggregation pipes to exclude archived repos when deriving vulnerability-related rollups (lastVulnerabilityScanStatus and per-project vulnerability counts).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
services/libs/tinybird/pipes/vulnerabilities_summary.pipe	Excludes archived repo URLs from the vulnerability summary query scope.
services/libs/tinybird/pipes/vulnerabilities_list.pipe	Excludes archived repo URLs in both count and list branches.
services/libs/tinybird/pipes/vulnerabilities_by_severity.pipe	Excludes archived repo URLs from severity aggregation.
services/libs/tinybird/pipes/vulnerabilities_by_ecosystem.pipe	Excludes archived repo URLs from ecosystem aggregation.
services/libs/tinybird/pipes/insights_projects_populated_copy.pipe	Excludes archived repos when computing lastVulnerabilityScanStatus rollup per project.
services/libs/tinybird/pipes/agentic_ai_projects_list_copy.pipe	Excludes archived repos from vulnerability counts while keeping other metrics unaffected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.