feat: security researchers leaderboard from GitHub advisory credits

[PrestaEdit]

Why

Security contributions are currently invisible on the Top Contributors site: vulnerability fixes land through a private security repository and are republished by the core team, so the original reporter/researcher is lost and never shows up in the PR or commit leaderboards. This came out of a community discussion — the point being that surfacing the people who find and report vulnerabilities (whatever their level) is exactly the kind of contribution the Top exists to encourage.

GitHub already exposes this data: GET /repos/PrestaShop/{repo}/security-advisories returns published advisories with credits_detailed, which distinguishes the research side (finder / reporter / analyst / coordinator) from the remediation side (remediation_developer / reviewer / verifier).

What this does

Two new commands, following the existing Fetch* / Generate* pipeline pattern:

• traces:fetch:security-advisories — scans every org repository, keeps published (non-withdrawn) advisories, and stores their accepted credits → gh_security_advisories.json. All credit roles are stored (raw data).
• traces:generate:topsecurity — builds top_security.json, ranking contributors by the number of advisories where they hold a research credit.

Design decision: research credits only

The leaderboard intentionally counts research credits only (finder / reporter / analyst / coordinator). Remediation credits are excluded: the core developers who ship the fix are commits and PRs that are already counted in the existing reviewers / issues / PR leaderboards, so crediting them again here would double-count them and bury the security researchers this board is meant to surface.

The fetch step still stores every credit role, so remediation data remains available for any future use — only the generate step filters.

Output

top_security.json has the same shape as the other rankings ({updatedAt, items:[{rank, login, name, avatar_url, html_url, count}]}), so the front end reuses its existing ranking table as-is.

Notes

• No new dependency; uses the already-bundled knplabs/github-api HTTP client.
• phpstan and php-cs-fixer pass.
• Wired into bin/console, the Makefile, and the README.
• Heads-up for the deploy pipeline: the TopContributors site consumes top_security.json, so its build only picks this up after a new traces release tag is published. The matching front-end PR should be merged after this one is released.

⚠️ Known limitation (process, not code): no PrestaShop advisory published since ~May 2024 has its credits filled in, so the current output is mostly 2020–2024 history. Credits are retro-editable on published advisories — filling them going forward is a security-team process topic, and this feature is the concrete argument for doing so.

🤖 Generated with Claude Code