[mbani01]

Summary

Follow-up to #4887. The git-activity contributors sync now authenticates to Tinybird with CROWD_PACKAGES_TB_TOKEN, a dedicated token that only has read access to repo_commit_contributors_copy_ds, instead of the shared CROWD_TINYBIRD_ACTIVITIES_TOKEN default of TinybirdClient.

Changes

• config.ts: getPackagesTinybirdToken() reads CROWD_PACKAGES_TB_TOKEN and throws when it is missing, so a misconfigured deployment fails at the first run instead of making unauthenticated calls.
• syncGitActivityContributors.ts: passes that token to TinybirdClient.
• Test asserts the token reaches the client.

Deployment

CROWD_PACKAGES_TB_TOKEN must be set on the security-contacts-worker deployment. CROWD_TINYBIRD_BASE_URL is still read by the client.

[cursor]

PR Summary

Medium Risk
Requires a new env var at deploy time; misconfiguration will break the sync, but the change reduces credential scope to read-only access for the contributors dataset.

Overview
Git-activity contributor sync now authenticates to Tinybird with a packages-scoped token from CROWD_PACKAGES_TB_TOKEN instead of relying on TinybirdClient's default CROWD_TINYBIRD_ACTIVITIES_TOKEN.

getPackagesTinybirdToken() uses the same required-env pattern as other packages worker config, so a missing variable fails at startup/sync rather than calling Tinybird with the wrong or empty credential. syncGitActivityContributors passes that value into new TinybirdClient(...), and tests mock the config helper and assert the client receives the token.

Deployment: set CROWD_PACKAGES_TB_TOKEN on the worker deployment (e.g. security-contacts-worker).

^{Reviewed by Cursor Bugbot for commit de645b7. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

🟢 Approval recommended

The narrowly scoped changes have no identified blocking issues; deployment must supply CROWD_PACKAGES_TB_TOKEN.

0 open findings

What changed in this PR

Updates the git-activity contributors sync to use a dedicated, read-only Tinybird token instead of the shared activities token.

Changes:

• Requires CROWD_PACKAGES_TB_TOKEN through a configuration getter.
• Passes the dedicated token to TinybirdClient.
• Adds a test assertion verifying token forwarding.

File	Description
services/​apps/​packages_worker/​src/​member-contributors/​git-activity/​syncGitActivityContributors.ts	Supplies the dedicated token to Tinybird.
services/​apps/​packages_worker/​src/​member-contributors/​__tests__/​syncGitActivityContributors.test.ts	Verifies the client receives the token.
services/​apps/​packages_worker/​src/​config.ts	Adds the required token getter.

🧠 Review effort: Balanced

---

Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}