fix: exclude archived repos from vulnerability data in Tinybird pipes (IN-1186)

[joanagmaia]

Summary

• Vulnerabilities from archived repositories were being surfaced on the Insights Security page, leading to misleading CVE reports for repos that are no longer actively maintained
• Adds archived = false / archived != true filters to the 4 vulnerability endpoint pipes and the 2 COPY pipes that aggregate vulnerability data
• segments_filtered.pipe is intentionally untouched — the filter is applied surgically only to vulnerability queries so other metrics (commits, stars, contributors, etc.) still include archived repos

Pipes changed

Pipe	Change
vulnerabilities_list.pipe	Filter added to both the count and listing branches
vulnerabilities_by_ecosystem.pipe	Filter added
vulnerabilities_by_severity.pipe	Filter added
vulnerabilities_summary.pipe	Filter added
insights_projects_populated_copy.pipe	last_vulnerability_scan_status node excludes archived repos (drives lastVulnerabilityScanStatus on the project card)
agentic_ai_projects_list_copy.pipe	vulnerability_counts node filters r.archived = false on the existing repositories join

References

• [Report issue] bootc  insights#1948
• [Report issue] Cilium  insights#1968
• IN-1186

---

Note

Low Risk
Scoped SQL WHERE clauses on read/analytics pipes with no auth or write-path changes; main effect is corrected security reporting numbers.

Overview
Vulnerability-facing Tinybird pipes no longer count or list CVEs tied to archived repositories, so Insights Security and related aggregates stop surfacing stale findings from unmaintained repos.

The filter is applied only on vulnerability queries: vulnerabilities_list, vulnerabilities_summary, vulnerabilities_by_ecosystem, and vulnerabilities_by_severity add repoUrl NOT IN (SELECT url FROM repositories FINAL WHERE archived = true) (including both count and list branches in vulnerabilities_list). COPY pipes insights_projects_populated_copy (last_vulnerability_scan_status) and agentic_ai_projects_list_copy (vulnerability_counts via r.archived = false) get the same behavior for project cards and Agentic AI lists. segments_filtered is unchanged, so non-security metrics (commits, stars, etc.) still include archived repos.

^{Reviewed by Cursor Bugbot for commit 973db79. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

This PR updates Tinybird vulnerability-related pipes to stop surfacing CVE/vulnerability data (and derived scan status) for repositories marked as archived, so Insights Security views don’t report misleading vulnerability posture for inactive repos.

Changes:

• Added an “exclude archived repositories” filter to all four vulnerability endpoint pipes (vulnerabilities_list, vulnerabilities_summary, vulnerabilities_by_severity, vulnerabilities_by_ecosystem).
• Updated two COPY aggregation pipes to exclude archived repos when deriving vulnerability-related rollups (lastVulnerabilityScanStatus and per-project vulnerability counts).

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
services/libs/tinybird/pipes/vulnerabilities_summary.pipe	Excludes archived repo URLs from the vulnerability summary query scope.
services/libs/tinybird/pipes/vulnerabilities_list.pipe	Excludes archived repo URLs in both count and list branches.
services/libs/tinybird/pipes/vulnerabilities_by_severity.pipe	Excludes archived repo URLs from severity aggregation.
services/libs/tinybird/pipes/vulnerabilities_by_ecosystem.pipe	Excludes archived repo URLs from ecosystem aggregation.
services/libs/tinybird/pipes/insights_projects_populated_copy.pipe	Excludes archived repos when computing lastVulnerabilityScanStatus rollup per project.
services/libs/tinybird/pipes/agentic_ai_projects_list_copy.pipe	Excludes archived repos from vulnerability counts while keeping other metrics unaffected.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 1 comment.

[gaspergrom]

LGTM