feat: [IANDT-237] add active contributor emitter

[jonnyowenpowell]

Description

This PR adds an API client for the public submit contributing developers endpoint served by the entitlements-service (pkg/apiclients/contributors_ingest), a helper function to collect contributor data (contributors.go) from the Git repository the command is being run in, and an emitter object (billing.go) which ties the two together, exposing an Emit function to perform the work.

Checklist

• Tests added and all succeed (make test)
• Regenerated mocks, etc. (make generate)
• Linted (make lint)
• Test your changes work for the CLI
  1. Clone / pull the latest CLI main.
  2. Run go get github.com/snyk/go-application-framework@YOUR_LATEST_GAF_COMMIT in the cliv2 directory.
     • Tip: for local testing, you can uncomment the line near the bottom of the CLI's go.mod to point to your local GAF code.
  3. Run go mod tidy in the cliv2 directory.
  4. Run the CLI tests and do any required manual testing.
  5. Open a PR in the CLI repo now with the go.mod and go.sum changes.
  • Once this PR is merged, repeat these steps, but pointing to the latest GAF commit on main and update your CLI PR.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues
✅	Secrets	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8796cbc. Configure here.}

[jonnyowenpowell]

Remember to assess bringing back capability check

[jonnyowenpowell]

Remember to assess bringing back capability check

Done, this doesn't belong here - and will instead be checked in the code that may call Emit.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Nested Retry Storm 🔴 [critical] The retrying function wraps an existing http.Client with a new RetryMiddleware, but the base client received from the engine (via billing.go) already contains the framework's default retry middleware. This creates a nested retry structure where each attempt of the outer 3-attempt cycle triggers a full internal retry cycle (typically another 3 attempts), potentially resulting in 9 requests per failure. Furthermore, since the inner middleware still uses the framework's slower default backoff (5s), the outer layer's 1s override is ignored during the inner retry phase, failing to meet the tight 10s budget. func retrying(base *http.Client, logger *zerolog.Logger) *http.Client { client := &http.Client{} transport := http.DefaultTransport if base != nil { *client = *base if base.Transport != nil { transport = base.Transport } } if logger == nil { nop := zerolog.Nop() logger = &nop } // The retry middleware reads only these two keys, so the policy is owned here // rather than by whatever configuration the caller happens to hold. config := configuration.NewWithOpts() config.Set(middleware.ConfigurationKeyRequestAttempts, requestAttempts) client.Transport = middleware.NewRetryMiddleware( config, logger, transport, middleware.WithRetryInterval(retryInterval), ) return client } Risky Early-Stop Logic 🟠 [major] The logic to stop git log iteration early assumes that a 'commit date <= authored date' relationship exists and makes the cutoff safe. In Git, the relationship is typically the inverse: AuthorDate <= CommitterDate. If the developer's stated assumption holds, stopping on an old CommitterDate is actually unsafe because a newer AuthorDate could still fall within the 90-day window. While the code is likely safe for standard Git usage (where Committer is the upper bound), the contradiction between the comment and the code's safety requirements suggests a logic error that could lead to under-counting contributors if clocks are skewed or non-standard Git workflows are used. err = iter.ForEach(func(commit *object.Commit) error { if commit.Committer.When.Before(since) { return storer.ErrStop }

📚 Repository Context Analyzed This review considered 49 relevant code sections from 15 files (average relevance: 0.96) pkg/apiclients/feature_flag_gateway/mocks/feature_flag_gateway.go (lines 1-194) internal/api/policy/2024-10-15/gen.go (lines 1-4) pkg/apiclients/ldx_sync_config/ldx_sync/2026-05-07/ldx_sync.go (lines 1-230) pkg/apiclients/feature_flag_gateway/2024-10-15/feature_flag_gateway.go (lines 1-253) internal/api/fileupload/uploadrevision/client.go (lines 1-263) pkg/mocks/workflow.go (lines 1-232) pkg/apiclients/fileupload/client.go (lines 1-178) ... and 8 more file(s)

🤖 Repository instructions applied (from AGENTS.md)

[jonnyowenpowell]

Move this package to internal