fix: exclude bot actors from the cost table and forked repos from the analysis - #10
Merged
Conversation
The people/cost table is built from PR data fetched via GraphQL, where a Bot actor's login has no [bot] suffix (that suffix is REST-only). The old name-based filter therefore missed GitHub Apps like greptile-apps. Query each actor's __typename instead and drop anything typed Bot, for mergers, reviewers, and commenters alike.
Forks inherit upstream code and vulnerabilities the org doesn't own, so their Dependabot churn and CVE alerts are noise. Capture the repo fork flag (which the collector wasn't reading) and drop forks in filterRepos alongside archived repos, removing them from CVE exposure, toil, and coverage.
blimmer
marked this pull request as ready for review
May 26, 2026 15:59
jcarver989
pushed a commit
that referenced
this pull request
May 27, 2026
🤖 I have created a release *beep* *boop* --- ## [0.1.0](v0.0.1...v0.1.0) (2026-05-26) ### Features * add interactive prompts and report sharing ([#4](#4)) ([23e8543](23e8543)) * bootstrap repo ([57653df](57653df)) * CLI entrypoint and project docs ([073dccb](073dccb)) * core infrastructure — Context, IO, GitHub client, analytics ([edd14ac](edd14ac)) * data collectors and dependency-bump heuristics ([2ef4ad3](2ef4ad3)) * React report web UI and build script ([00dd2ec](00dd2ec)) * refocus the report on engineer toil and polish the UI ([#9](#9)) ([ae6853f](ae6853f)) * report aggregation, cost model, bundling, and HTML render ([376adb8](376adb8)) * waitlist via upload ([#12](#12)) ([b2050e3](b2050e3)) ### Bug Fixes * allow setting numberstepper directly ([367beb8](367beb8)) * double counting reviewers and mergers ([2cfa24e](2cfa24e)) * exclude bot actors from the cost table and forked repos from the analysis ([#10](#10)) ([7ce42f0](7ce42f0)) * improved sources ([#13](#13)) ([010a11a](010a11a)) * streamline CLI share prompts ([#11](#11)) ([066465c](066465c)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please). Co-authored-by: contextbridge-pr-automation[bot] <259134118+contextbridge-pr-automation[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two report-accuracy fixes from real-org feedback. First, GitHub App bots (e.g.
greptile-apps) were appearing in the engineer cost/people table; they're now excluded. Second, forked repos were inflating the analysis with upstream code the org doesn't own; they're now dropped from the entire crawl, the same way archived repos are.Review focus
__typename, not name. The PR data comes from GraphQL, where a Bot actor'sloginhas no[bot]suffix (REST-only) — which is why the old denylist missed GitHub Apps. We now drop any actor GitHub types asBot. Trade-off: a bot implemented as a plain machine-user account would still read asUserand slip through; that case would need a name denylist.filterReposalongside archived, so they drop out of toil/backlog/coverage as well as CVE. This protects the toil headline's credibility (no abandoned-fork churn) at the cost of not counting any genuinely-maintained fork.Commits
3831dd1— fix: exclude GitHub App bots from the cost tablee6fd770— fix: exclude forked repos from the analysis