Skip to content

feat(tcfeed): keep repositories nobody has starred out of the table - #133

Merged
ralyodio merged 1 commit into
masterfrom
tcfeed-min-stars
Aug 14, 2026
Merged

feat(tcfeed): keep repositories nobody has starred out of the table#133
ralyodio merged 1 commit into
masterfrom
tcfeed-min-stars

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Nine of the seventeen repositories asked in today's batch had under fifteen stars and five had two or fewer. In several, the request arrived as issue #1 and pull request #1 of a repository nobody has looked at yet — coldmill, EntityIdentifierResolver, gomorph, svarm, claude-bridge.

Two reasons to stop, and the second is the one that matters:

  1. They will not be read. A repository with no stars and no issues has no maintainer attention to win. The whole premise of asking first is that somebody is there to answer.
  2. It is the shape of activity the acceptable use policy is least forgiving about. Bulk unsolicited pull requests are judged on the pattern, not on each one, and "opened issue feat: add ssh-login-monitor module to store #1 in forty repositories with no stars" is that pattern described exactly.

What changed

TCFEED_MIN_STARS, default 5, 0 turns it off.

Five rather than fifteen because the aim is to drop repositories that are unattended, not small — nsproxy at 84 stars and ZeroDroid at 6 are real projects with real users, and the floor should not have an opinion about them.

Placed above the scan, so a repository under the floor is never cloned. It costs one metadata call and saves a clone.

The one real trade

It is remembered rather than reconsidered. A star count can change where archived cannot, so a repository that grows past the floor later will not come back. Re-deciding it every run would instead burn one of the twenty slots each time and crowd out candidates that would actually be scanned. Flagging it explicitly rather than burying it.

Verification

Both directions, against an isolated TCFEED_CACHE so real state was untouched:

  • TCFEED_MIN_STARS=999999 — every repository gated, nothing cloned, table comes back empty:
    · chintan-diwakar/prompt-contribution-graph (9 stars)
    · svarmdev/svarm (0 stars)
    · EventSource/eventsource (1153 stars)
    
  • TCFEED_MIN_STARS=0 — no repository gated, table builds as before (Vulkan-Docs 3317, hexclave 6842).

🤖 Generated with Claude Code

Nine of the seventeen repositories asked in today's batch had under
fifteen stars and five had two or fewer. In several the request arrived
as issue #1 and pull request #1 of a repository nobody has looked at
yet — coldmill, EntityIdentifierResolver, gomorph, svarm, claude-bridge.

Two reasons to stop, and the second is the one that matters:

  They will not be read. A repository with no stars and no issues has no
  maintainer attention to win. The whole premise of asking first is that
  somebody is there to answer.

  It is the shape of activity the acceptable use policy is least
  forgiving about. Bulk unsolicited pull requests are judged on the
  pattern, not on each one, and "opened issue #1 in forty repositories
  with no stars" is that pattern described exactly.

TCFEED_MIN_STARS, default 5, 0 turns it off. Five rather than fifteen
because the aim is to drop repositories that are unattended, not small
ones — nsproxy at 84 stars and ZeroDroid at 6 are real projects with
real users, and the floor should not have an opinion about them.

Placed above the scan, so a repository under the floor is never cloned.
It costs one metadata call and saves a clone.

Remembered rather than reconsidered, which is the one real trade here: a
star count can change where `archived` cannot, so a repository that
grows past the floor later will not come back. Re-deciding it every run
would instead burn one of the twenty slots each time and crowd out
candidates that would actually be scanned.

Verified both directions against an isolated cache: at 999999 every
repository is gated and nothing is cloned, and the table comes back
empty; at 0 no repository is gated and the table builds as before.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

67 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1

Severity Rule Location
HIGH secret-aws-access-key prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
HIGH sh-eval-expansion .githooks/pre-commit:26
HIGH sh-remote-script-execution apps/web/public/install.sh:272
HIGH sh-remote-script-execution apps/web/public/install.sh:320
HIGH secret-generic-credential modules/spend-guard/config/example.conf.toml:13
HIGH secret-generic-credential modules/spend-guard/README.md:84
HIGH secret-generic-credential PRD.md:268
HIGH tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
HIGH tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
HIGH sh-remote-script-execution scripts/smoke-test.sh:46
HIGH sh-remote-script-execution scripts/smoke-test.sh:47
MEDIUM insecure-temp-file .githooks/commit-msg:16
MEDIUM insecure-temp-file .githooks/post-commit:20
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:70
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:79
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/service.ts:88
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/service.ts:111
MEDIUM sql-template-interpolation apps/cli/src/core/state.ts:121
MEDIUM sql-template-interpolation apps/cli/src/core/state.ts:125
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:31
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:33
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:34
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:35
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:36
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:43
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:49
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:56
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:63
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:82
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:84
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:85
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:93
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:98
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:105
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:112
MEDIUM js-shell-exec-interpolation apps/cli/src/index.ts:419
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:180
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:184
MEDIUM js-open-redirect apps/web/src/app/auth/login/page.tsx:50
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:125
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:153
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:157
MEDIUM js-unescaped-html-sink apps/web/src/app/get-whitepaper/page.tsx:346
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:211
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:215
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:219
MEDIUM js-unescaped-html-sink apps/web/src/app/page.tsx:120
MEDIUM js-unescaped-html-sink apps/web/src/app/store/[slug]/page.tsx:107
MEDIUM js-open-redirect apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM manifest-install-lifecycle-script package.json:24

…and 17 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 9283800 into master Aug 14, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant