Skip to content

feat(tcfeed): bound the search at 1k..10k stars - #115

Merged
ralyodio merged 1 commit into
masterfrom
tcfeed-star-range
Aug 13, 2026
Merged

feat(tcfeed): bound the search at 1k..10k stars#115
ralyodio merged 1 commit into
masterfrom
tcfeed-star-range

Conversation

@ralyodio

Copy link
Copy Markdown
Contributor

Adds an upper bound to the search source, and uses the a..b form to express it.

tcfeed: 50 to consider — 40 from r/coolgithubprojects, 10 from search (stars:1000..10000)

Two traps, both of which return results rather than errors

This is the part worth keeping. stars:>1000 stars:<10000 is the obvious way to write "between 1k and 10k" and it is wrong:

$ gh search repos "stars:>1000 stars:<10000" --sort updated --limit 6
8381   EpicGames/lore
1069   mqttsnet/thinglinks
2680   MIgHTy-alIeN/ai-trader-bot
2412   dedicatedcode/reitti
1522   VKCOM/kphp
58955  meilisearch/meilisearch     <-- outside the bound it appears to state

Two range qualifiers on one field do not AND. The a..b form does:

$ gh search repos "stars:1000..10000" --sort updated --limit 10
1791 4006 2199 1069 2680 2412 1522 2086 5662 8381   <-- all inside

The other trap, from the previous PR and still live: the qualifier is stars, and starts: is not rejected — GitHub treats it as a free-text search for the word and returns repositories with no stars at all. Both are now documented beside the default, because a query that is wrong in either direction looks like it worked.

The upper bound earns its place

It is not just narrowing for its own sake. Without it the band is dominated by monorepos that TOO_BIG_KB throws away only after a clone has decided they are too large. Measured over twenty results each:

Query Scannable Discarded as too big
stars:>1000 12 8
stars:1000..10000 14 6

supabase (2371MB), openclaw (2458MB) and metabase (2122MB) drop out of the band entirely rather than being cloned and rejected.

Verified

tsc --strict clean, and run end to end against the live API with TCFEED_MAX=0 so nothing was cloned — 10 from search, all inside the band, merged and deduped with the 40 from reddit.

🤖 Generated with Claude Code

An upper bound, and the `a..b` form to express it.

Two traps live in that one string and both produce a *result* rather
than an error, so both are now written down beside the default:

  starts:1000..10000       the qualifier is `stars`. Misspelt, GitHub
                           does not reject it - it becomes a free-text
                           search for the word and returns repositories
                           with no stars at all.

  stars:>1000 stars:<10000 two range qualifiers on one field do not
                           AND. This form was tried first and returned
                           meilisearch at 58,955 stars, comfortably
                           outside the bound it appears to state.

The upper bound earns its place rather than just narrowing for its own
sake. Without it the band is dominated by monorepos that TOO_BIG_KB
throws away only after a clone has decided they are too large. Measured
over twenty results each: `stars:>1000` yields twelve scannable against
eight discarded, `stars:1000..10000` yields fourteen against six -
supabase at 2371MB, openclaw at 2458MB and metabase at 2122MB drop out
of the band entirely.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
@github-actions

Copy link
Copy Markdown

ThreatCrush Security Scan

67 finding(s)

HIGH/CRITICAL: 11 | MEDIUM: 55 | LOW: 1

Severity Rule Location
HIGH secret-aws-access-key prd/0003-detect-hardcoded-secrets-before-they-are-committed-or-served.md:126
HIGH sh-eval-expansion .githooks/pre-commit:26
HIGH sh-remote-script-execution apps/web/public/install.sh:272
HIGH sh-remote-script-execution apps/web/public/install.sh:320
HIGH secret-generic-credential modules/spend-guard/config/example.conf.toml:13
HIGH secret-generic-credential modules/spend-guard/README.md:84
HIGH secret-generic-credential PRD.md:268
HIGH tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:121
HIGH tls-verification-disabled prd/0004-find-dangerous-code-patterns-without-pretending-to-be-a-compiler.md:122
HIGH sh-remote-script-execution scripts/smoke-test.sh:46
HIGH sh-remote-script-execution scripts/smoke-test.sh:47
MEDIUM insecure-temp-file .githooks/commit-msg:16
MEDIUM insecure-temp-file .githooks/post-commit:20
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:70
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/init.ts:79
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/service.ts:88
MEDIUM js-shell-exec-interpolation apps/cli/src/commands/service.ts:111
MEDIUM sql-template-interpolation apps/cli/src/core/state.ts:121
MEDIUM sql-template-interpolation apps/cli/src/core/state.ts:125
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:31
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:33
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:34
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:35
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:36
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:43
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:49
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:56
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:63
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:82
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:84
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:85
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:93
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:98
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:105
MEDIUM js-shell-exec-interpolation apps/cli/src/daemon/firewall/adapters.ts:112
MEDIUM js-shell-exec-interpolation apps/cli/src/index.ts:419
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:180
MEDIUM js-unescaped-html-sink apps/web/src/app/about/page.tsx:184
MEDIUM js-open-redirect apps/web/src/app/auth/login/page.tsx:50
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:125
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:153
MEDIUM js-unescaped-html-sink apps/web/src/app/blog/[slug]/page.tsx:157
MEDIUM js-unescaped-html-sink apps/web/src/app/get-whitepaper/page.tsx:346
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:211
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:215
MEDIUM js-unescaped-html-sink apps/web/src/app/layout.tsx:219
MEDIUM js-unescaped-html-sink apps/web/src/app/page.tsx:120
MEDIUM js-unescaped-html-sink apps/web/src/app/store/[slug]/page.tsx:107
MEDIUM js-open-redirect apps/web/src/components/funding/FundingClient.tsx:97
MEDIUM manifest-install-lifecycle-script package.json:24

…and 17 more. Full results in the Security tab.

Snippets are redacted; ThreatCrush never prints matched credential material.

@ralyodio
ralyodio merged commit 74a90fb into master Aug 13, 2026
11 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant