feat: add filters and risk sort to GET /v1/packages

[gaspergrom]

Summary

Extends GET /v1/packages with the additional filters and sort options currently handled post-fetch on the consumer side, moving them into the DB layer.

• Status filter (status=unassigned|open|assessing|active|...) — filters by stewardship status; unassigned includes packages with no stewardship row
• Health band filter (healthBand=healthy|fair|concerning|critical) — filters by scorecard score (0–10 × 10 = 0–100 health), using best-confidence linked repo
• Vuln severity filter (vulnSeverity=any|high|critical) — filters by worst advisory severity rank across all open advisories
• Risk sort (sortBy=risk) — composite score: impact + health deficit + vuln exposure + bus factor + staleness
• Health in response — health field now returns the scorecard-based 0–100 value instead of always null
• Lifecycle null exclusion bug — when lifecycle is passed, packages with no registry status (p.status IS NULL) are excluded from results
• Name search (already on branch) — name param for case-insensitive ILIKE filter

Changes

• backend/src/api/public/v1/packages/listPackages.ts — new Zod params (status, healthBand, vulnSeverity, risk sort), forwarded to DAL; filters and health in response updated
• services/libs/data-access-layer/src/osspckgs/api.ts — new ListPackagesOptions fields; added LATERAL joins for scorecard (r_sc) and max advisory severity rank (ap_severity); shared laterals fragment used in both paginated query and empty-page COUNT fallback; risk sort expression inline in SQL

[Copilot]

Copilot encountered an error: Your billing is not configured or you have Copilot licenses from multiple standalone organizations or enterprises. To use premium requests, select a billing entity via the GitHub site, under Settings > Copilot > Features.

[github-actions]

⚠️ Jira Issue Key Missing

Your PR title doesn't contain a Jira issue key. Consider adding it for better traceability.

Example:

• feat: add user authentication (CM-123)
• feat: add user authentication (IN-123)

Projects:

• CM: Community Data Platform
• IN: Insights

Please add a Jira issue key to your PR title.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 4e0679d. Configure here.}

[cursor]

Lifecycle filter ignores value

Medium Severity

When lifecycle is passed from the list endpoint, the DAL only adds p.status IS NOT NULL and never compares the requested lifecycle value (active, stable, declining, abandoned). Every lifecycle choice returns the same result set while the response still echoes the chosen filter.

 

^{Reviewed by Cursor Bugbot for commit 4e0679d. Configure here.}

[cursor]

Scorecard repo pick inconsistent

Medium Severity

The new r_sc lateral picks a linked repo with ORDER BY pr.confidence DESC only. Package detail elsewhere breaks ties by preferring declared source, so list health, healthBand, and sortBy=health|risk can use a different scorecard than the detail view for the same package.

 

^{Reviewed by Cursor Bugbot for commit 4e0679d. Configure here.}