fix: cargo repo gap (CM-1305)

[ulemons]

Summary

Fixes the cargo repo-normalization gap (CM-1305 follow-up): declared repo URLs from crates.io often arrive in shorthand (github:owner/repo), SSH (git@github.com:owner/repo.git), or junk/homepage form instead of a canonical https://<host>/<owner>/<name> URL. packages.repository_url was left null or wrong for these cases, and repos/package_repos could drift out of sync with it entirely.

Adds a normalizeRepos step that canonicalizes every distinct declared_repository_url staged in a dump into cargo_sync.repo_norm, then wires that canonical mapping into both enrichPackages (packages.repository_url) and enrichRepos (repos.url / package_repos), so both tables always agree on the same canonical value.

Changes

• Add normalizeRepos (cargo/normalizeRepos.ts): builds cargo_sync.repo_norm(declared, repository_url, host) via the shared canonicalizeRepoUrl (same normalizer npm/pypi use). Only inputs reducible to an owner/name pair are stored; unparseable declared URLs are omitted, so a LEFT JOIN naturally yields NULL.
• Wire enrichPackages to write packages.repository_url from repo_norm only when the current dump supplies a declared_repository_url — preserves the existing value when a dump omits the field, instead of wiping it.
• Rewrite enrichRepos to join through repo_norm instead of the raw declared URL, and to prune stale source='declared' package_repos links before relinking (mirrors the existing pattern in maven/backfillRepositoryUrl.ts) — covers both junk declared values (no canonical → link removed) and rewrites (declared URL now maps to a different repo).
• Register cargoNormalizeRepos in the top-level activities barrel (src/activities.ts) — it was implemented but never exported, so the Temporal worker could not dispatch it.
• Extend EnrichReposResult with a pruned count for observability.

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1305

---

Note

Medium Risk
Changes package–repo linkage and packages.repository_url for all cargo sync runs; incorrect canonicalization or pruning could affect downstream consumers (e.g. security-contacts) that join via package_repos.

Overview
Fixes cargo repo handling so canonical repository URLs stay aligned across packages, repos, and package_repos instead of using raw crates.io declared_repository_url values (shorthand, SSH, junk, etc.).

Adds a cargoNormalizeRepos step after dump load that rebuilds staging table repo_norm by mapping each distinct declared URL through shared canonicalizeRepoUrl (same as npm/pypi). enrichPackages now sets packages.repository_url from that mapping when the dump includes a declared URL, and leaves the existing value when the field is absent. enrichRepos inserts repos and package_repos via repo_norm, prunes stale source='declared' links before relinking, and on link conflict only bumps confidence (does not overwrite source). The activity is exported and wired into cargoSyncWorkflow; EnrichReposResult gains a pruned count.

^{Reviewed by Cursor Bugbot for commit 1b5bde2. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds canonical repository URL normalization to Cargo package synchronization.

Changes:

• Builds a staging map of declared URLs to canonical URLs.
• Updates package enrichment and audit tracking.
• Adds a Temporal normalization activity.

The PR title is missing the required JIRA key.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
cargo/workflows.ts	Runs repository normalization before enrichment.
cargo/types.ts	Defines normalization result counts.
cargo/normalizeRepos.ts	Builds the canonical URL mapping.
cargo/enrich.ts	Updates and audits package repository URLs.
cargo/activities.ts	Exposes the normalization activity.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated 3 comments.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 2155132. Configure here.}

[cursor]

Stale repository_url after repo removal

Medium Severity

When staging has declared_repository_url NULL (empty crate repository in the dump), enrichRepos prunes all source='declared' package_repos rows, but enrichPackages keeps the prior packages.repository_url via the CASE else branch. package_repos and packages.repository_url can disagree after a crate drops its repository.

Additional Locations (1)

• services/apps/packages_worker/src/cargo/enrich.ts#L203-L216

 

^{Reviewed by Cursor Bugbot for commit 2155132. Configure here.}

[Copilot]

Pull request overview

Copilot reviewed 6 out of 6 changed files in this pull request and generated no new comments.