feat: add GitHub security funnel table widget IN-1293

[gaspergrom]

Summary

Standalone insights code for widget 08 of the Health Score Coverage report (IN-1293) — a table showing security-signal coverage across GitHub-hosted repos, split into a Linux Foundation and Other projects column, funnel-shaped by stage (Tracked in Insights → Health score published → Security category scored → Scanned by Scorecard).

• github-security-funnel.vue — table widget, skeleton loading state, empty state, footnote with the lf_non_github count
• health-score-coverage-github-security.ts — data-fetcher + mapper (no scope param — the pipe returns both LF/Other columns in one call)
• health-score-coverage-github-security.test.ts — mapper unit tests, including a funnel-monotonicity assertion
• github-security.get.ts — API route
• github-security.query.ts — TanStack Query wrapper
• health-score-coverage-github-security.types.ts — standalone types

Standalone widget code only — NOT yet wired into the shared report view/service/types/data files. Wiring happens in a follow-up once prior widgets (#2164, #2165, #2166, #2167) merge into this release branch and it's IN-1293's turn in the sequential merge order. crowd.dev pipe health_score_report_github_security is already deployed to Tinybird production (crowd.dev PR #4582).

Ground-truth discrepancy found vs. dispatch brief

The Jira ticket's prose lists the four table rows in this order: "Tracked in Insights, Scanned by Scorecard, Security category scored, Health score published." Taken literally, that order is not monotonically decreasing given the pipe's own validated production data (e.g. Other: tracked=11712, health_published=10758, security_scored=7756, scorecard_scanned=5901) — which conflicts with the ticket's own acceptance criterion "Each stage count is ≤ the stage above it in both columns."

Built to the funnel order stated in the pipe's DESCRIPTION block (tracked >= health_published >= security_scored >= scorecard_scanned) and confirmed against live production data via the Tinybird MCP, treating the ticket's row-order sentence as a wording slip rather than the intended row order.

Test plan

• pnpm lint:fix — no errors (pre-existing warnings elsewhere, untouched)
• pnpm tsc-check — clean
• pnpm test --run — 254/254 passing, including the new mapper tests

• release/IN-1276-health-score-coverage - ⚠️ No PR associated with branch
  • feat: add GitHub security funnel table widget IN-1293 👈

[Copilot]

Pull request overview

Adds a standalone GitHub security-coverage funnel widget for the Health Score Coverage report.

Changes:

• Adds the table widget with loading, empty, and footnote states.
• Adds Tinybird mapping, API, query, types, and tests.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
github-security-funnel.vue	Renders the funnel table and states.
github-security.query.ts	Fetches and caches widget data.
github-security.get.ts	Exposes the report API endpoint.
health-score-coverage-github-security.ts	Fetches and maps Tinybird rows.
health-score-coverage-github-security.test.ts	Tests mapping and fetching.
health-score-coverage-github-security.types.ts	Defines widget data contracts.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.