Uses tree-sitter to parse JS/TS files and extract top-level symbols
(functions, classes, variables, methods), then diffs them by content
hash to identify added/removed/modified symbols between two versions.
Intended to help correlate CVE fixes with specific changed functions.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
- Emit one release event per version published (not per package), using
the metadata time map to find versions published since last poll
- Add modification events for metadata-only changes (dist-tag moves,
maintainer updates, etc.) with full raw JSON body for diffing
- Include raw package metadata (versions key stripped) in release and
modification events for later analysis
- Store poll state as JSON (seq + timestamp) instead of plain seq
- Switch recorder to method=gcs (Pub/Sub writes directly to GCS,
eliminating the recorder Cloud Run service)
- Add queries.md with example BQ queries including a window-function
diff query for tracking metadata changes over time
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Go cron job that tails the npm CouchDB _changes feed, fetches package
metadata, and emits CloudEvents for releases and deletions. Events flow
through a Chainguard cloudevent-broker to a cloudevent-recorder that
streams them into BigQuery.
Infrastructure is managed with Terraform using chainguard-dev/terraform-
infra-common modules for networking, broker, recorder, and cron.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
