feat(security-contacts): resolve GitHub handles to emails using cdp identities [CM-1323]

[mbani01]

This pull request enhances the security contacts ingestion pipeline by integrating a new process to resolve GitHub handles to member emails using the CDP database. The update introduces a new database connection, adds logic to enrich contacts with resolved emails, and adjusts the contact scoring to account for the provenance and verification status of these emails.

Security contacts enrichment and scoring improvements:

• Added a new getCdpDbConfig function in config.ts and corresponding getCdpDb helper in db.ts to support connecting to the CDP database. [1] [2]
• Updated the security contacts batch and single-ingest activities to initialize and pass the CDP database connection, enabling downstream enrichment. [1] [2] [3] [4] [5] [6] [7]
• Introduced the resolveCdpEmails function, which maps GitHub handles to member IDs and fetches associated emails (verified and unverified) from the CDP, enriching contacts with these resolved email addresses. [1] [2] [3]
• Enhanced contact scoring logic to recognize CDP-resolved emails, applying specific penalties for unverified CDP emails and ensuring that CDP lookups do not count as independent corroboration for confidence scoring. [1] [2] [3] [4]

Database query improvements:

• Added findResolvableEmailsForMembers in the data-access layer to efficiently fetch both verified and unverified emails for a set of member IDs, including logic to promote username-verified emails.

[cursor]

PR Summary

Medium Risk
Reads member identity emails from CDP and changes stored contact sets and ranking; deploy must run workers on the new security-contacts-worker queue so scheduled ingestion still runs.

Overview
Security contacts ingestion now enriches github-handle contacts with member emails from the CDP read database before reconcile/scoring, using a new resolveCdpEmails step and findResolvableEmailsForMembers in the data-access layer (verified vs unverified, excluding noreply addresses).

The packages worker gains getCdpDb / CDP DB config and passes that connection through batch and on-demand ingest activities into processRepo. Scoring treats cdp-verified / cdp-unverified provenance with lower channel quality, an extra penalty when only unverified CDP sources apply, and excludes cdp-* sources from corroboration. Reconcile no longer caps output at five contacts.

Operations: the security-contacts Temporal schedule, Docker compose env, and npm scripts now use a dedicated security-contacts-worker task queue instead of packages-worker.

^{Reviewed by Cursor Bugbot for commit 178f6c0. Bugbot is set up for automated code reviews on this repo. Configure here.}

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[Copilot]

Pull request overview

This PR enhances the packages_worker security-contacts ingestion flow by adding a CDP (main Crowd DB) lookup step to resolve github-handle contacts into email contacts, and adjusting scoring so CDP-derived provenance affects confidence/quality appropriately.

Changes:

• Added a new DAL query (findResolvableEmailsForMembers) to fetch member emails (and promote certain identities to “verified”).
• Introduced a CDP DB config + connection helper in packages_worker, and plumbed a second QueryExecutor through security-contacts activities/batch/single ingest.
• Added resolveCdpEmails plus scoring updates to (a) avoid counting cdp-* sources as corroboration and (b) penalize CDP-unverified emails.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
services/libs/data-access-layer/src/members/identities.ts	Adds a DAL helper to fetch resolvable (verified/unverified) emails for a set of member IDs.
services/apps/packages_worker/src/security-contacts/score.ts	Updates scoring to treat cdp-* provenance differently (no corroboration; penalties for unverified).
services/apps/packages_worker/src/security-contacts/resolveCdpEmails.ts	New resolver that maps GitHub handles → member IDs → emails and emits enriched email contacts with CDP provenance.
services/apps/packages_worker/src/security-contacts/processBatch.ts	Wires CDP resolution into per-repo processing and updates batch function signature to accept cdpQx.
services/apps/packages_worker/src/security-contacts/ingestSingle.ts	Updates on-demand ingest to accept/pass cdpQx.
services/apps/packages_worker/src/security-contacts/activities.ts	Initializes both packages DB and CDP DB connections and passes them into batch/single activities.
services/apps/packages_worker/src/db.ts	Adds getCdpDb() helper.
services/apps/packages_worker/src/config.ts	Adds getCdpDbConfig() using CROWD_DB_* env vars.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit eb629f3. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 12 changed files in this pull request and generated 3 comments.