feat(integrity-analysis): add per-user analysis of filtered events

[Copilot]

Adds author_login-level bucketing and visualization to the daily DIFC integrity analysis workflow, complementing the existing per-tool and per-workflow breakdowns.

Changes

bucketize.py

• New by_user counter keyed by author_login, written into summary.json

Chart 4 — chart_users.py

• Horizontal bar chart of the top 20 users triggering DIFC filtering
• Green palette (BAR_COLOR = "#4CAF50") to visually distinguish from existing charts
• Output: /tmp/gh-aw/integrity/charts/top_users.png, uploaded as a workflow asset

Discussion report template

• 👤 Per-User Breakdown — collapsible table of all users with event counts
• 🔍 Per-User Analysis — embeds Chart 4 with guidance to distinguish automated actors (bots, Copilot agents) from human contributors

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/graphql
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw jPKw-s1_GrLj (http block)
  • Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw journal-or-kmsg (http block)
• https://api.github.com/repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/astral-sh/setup-uv/git/ref/tags/eac588ad8def6316056a12d4907a9d4d84ff7a3b --jq .object.sha eference/cross-repository.md (http block)
• https://api.github.com/repos/github/gh-aw
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility (http block)
  • Triggering command: /usr/bin/gh gh api /repos/github/gh-aw --jq .visibility c/content/docs/rremote.origin.url config r: $owner, name: $name) { hasDiscussionsEnabled } } remote.origin.ur/usr/bin/gh (http block)
• https://api.github.com/repos/githubnext/agentics/git/ref/tags/
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha (http block)
  • Triggering command: /usr/bin/gh gh api /repos/githubnext/agentics/git/ref/tags/# --jq .object.sha eference/glossary.md (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

📍 Connect Copilot coding agent with Jira, Azure Boards or Linear to delegate work to Copilot in one click without leaving your project management tool.

[Copilot]

Pull request overview

Adds per-author_login bucketing to the daily DIFC integrity analysis workflow and extends the report with a new top-users chart and per-user reporting sections.

Changes:

• Extend the bucketization summary to include by_user counts keyed by author_login.
• Add “Chart 4” generation instructions for a top-20 users horizontal bar chart and include it in the upload list.
• Update the discussion report template to include a per-user breakdown table and per-user analysis section embedding the new chart.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In the not events branch, summary.json is written with a different schema than the non-empty case (it omits integrity_tags and secrecy_tags). Since downstream steps/charts expect these keys to exist (even if empty), consider including them (and any other always-present keys) here as empty dicts to keep the summary schema consistent across runs.

Suggested change

	summary = {"total": 0, "by_tool": {}, "by_server": {}, "by_reason": {}, "by_hour": {}, "by_day": {}, "by_workflow": {}, "by_user": {}}
	summary = {
	"total": 0,
	"by_tool": {},
	"by_server": {},
	"by_reason": {},
	"by_hour": {},
	"by_day": {},
	"by_workflow": {},
	"by_user": {},
	"integrity_tags": {},
	"secrecy_tags": {},
	}