From 643e01d5af41a169e958d28daf31921b9b1a665d Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Tue, 28 Jul 2026 16:26:33 +0100 Subject: [PATCH 1/5] Add Ingest workflow: nightly brew advisory-match --all Runs brew advisory-match --all --output advisories --no-history at 08:20 UTC (offset from Regenerate at 06:20 so that job's source: generated records are on main and get skipped rather than overwritten) and opens a matched-advisories PR when anything changes. --no-history is used because the FormulaVersions walk for every :fixed hit across ~8500 formulae would exceed the job limit; new records get fixed: which reviewers tighten per CONTRIBUTING, and existing records keep their on-disk ranges via merge_existing. Merge only after Homebrew/brew#23329 ships in a tagged release. --- .github/workflows/ingest.yml | 66 ++++++++++++++++++++++++++++++++++++ 1 file changed, 66 insertions(+) create mode 100644 .github/workflows/ingest.yml diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml new file mode 100644 index 000000000..72d1079ff --- /dev/null +++ b/.github/workflows/ingest.yml @@ -0,0 +1,66 @@ +name: Ingest + +on: + schedule: + # Offset from Regenerate (06:20) so that job's PR has typically merged and + # the source: generated records this job must not overwrite are on main. + - cron: "20 8 * * *" + workflow_dispatch: + +permissions: + contents: write + pull-requests: write + +jobs: + match: + if: github.ref == 'refs/heads/main' + runs-on: macos-latest + # A full --all sweep queries OSV for every homebrew-core formula plus its + # distro/registry mappings; the calibration run in Homebrew/brew#23329 hit + # ~8.5s/formula, so allow the full 6h. + timeout-minutes: 360 + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + persist-credentials: false + + - name: Set up Homebrew + uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1 + + - name: Match advisories + env: + HOMEBREW_NO_AUTO_UPDATE: "1" + HOMEBREW_NO_INSTALL_FROM_API: "1" + HOMEBREW_DEVELOPER: "1" + # --no-history: the FormulaVersions walk for every :fixed hit across + # ~8500 formulae would exceed the job limit. New records get + # `fixed: ` which reviewers tighten per + # CONTRIBUTING; existing records keep their on-disk ranges via + # OsvExport.merge_existing regardless. Drop this flag once + # `brew advisory-match` gains a "walk history only for records not + # already on disk" mode. + run: brew advisory-match --all --output advisories --no-history + + - name: Open pull request + env: + GITHUB_TOKEN: ${{ github.token }} + BRANCH: matched-advisories + run: | + git config user.name "github-actions[bot]" + git config user.email "41898282+github-actions[bot]@users.noreply.github.com" + git add advisories/ + if git diff --cached --quiet; then + echo "No changes." + exit 0 + fi + gh auth setup-git --hostname github.com --force + git checkout -b "$BRANCH" + git commit -m "Matched advisory candidates" + git push --force origin "HEAD:refs/heads/$BRANCH" + if [ -n "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then + echo "PR already open." + else + gh pr create --base main --head "$BRANCH" \ + --title "Matched advisory candidates" \ + --body "Automated candidates via \`brew advisory-match --all\`. See [CONTRIBUTING.md](CONTRIBUTING.md#reviewing-matched-candidates) for the review checklist." + fi From 8a508c7983f215c6fb880693197060a3e7140f49 Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Tue, 28 Jul 2026 16:36:26 +0100 Subject: [PATCH 2/5] ingest.yml: absolute CONTRIBUTING link in PR body --- .github/workflows/ingest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index 72d1079ff..02fe2d55a 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -62,5 +62,5 @@ jobs: else gh pr create --base main --head "$BRANCH" \ --title "Matched advisory candidates" \ - --body "Automated candidates via \`brew advisory-match --all\`. See [CONTRIBUTING.md](CONTRIBUTING.md#reviewing-matched-candidates) for the review checklist." + --body "Automated candidates via \`brew advisory-match --all\`. See [CONTRIBUTING.md](https://github.com/${GITHUB_REPOSITORY}/blob/HEAD/CONTRIBUTING.md#reviewing-matched-candidates) for the review checklist." fi From 2687baaebf067e423da13974281b10adccba663d Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Tue, 28 Jul 2026 16:57:56 +0100 Subject: [PATCH 3/5] ingest.yml: rebuild data/advisories.json after matching Mirrors regenerate.yml (from #30): run rake advisories:concat after brew advisory-match writes to advisories/, and stage data/ so the concatenated corpus reflects the new matched records. Adds the setup-ruby step the rake task needs. Depends on #30 for the task itself. --- .github/workflows/ingest.yml | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index 02fe2d55a..fb3bbc86c 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -27,6 +27,9 @@ jobs: - name: Set up Homebrew uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1 + - name: Set up Ruby + uses: Homebrew/actions/setup-ruby@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1 + - name: Match advisories env: HOMEBREW_NO_AUTO_UPDATE: "1" @@ -41,6 +44,9 @@ jobs: # already on disk" mode. run: brew advisory-match --all --output advisories --no-history + - name: Concatenate advisories + run: rake advisories:concat + - name: Open pull request env: GITHUB_TOKEN: ${{ github.token }} @@ -48,7 +54,7 @@ jobs: run: | git config user.name "github-actions[bot]" git config user.email "41898282+github-actions[bot]@users.noreply.github.com" - git add advisories/ + git add advisories/ data/ if git diff --cached --quiet; then echo "No changes." exit 0 From 41f68df106c0d340db9e12e8baca355a1eb85547 Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Mon, 3 Aug 2026 09:17:46 +0100 Subject: [PATCH 4/5] ingest.yml: enable bundler-cache for rake advisories:concat --- .github/workflows/ingest.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index fb3bbc86c..65d4457ec 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -29,6 +29,8 @@ jobs: - name: Set up Ruby uses: Homebrew/actions/setup-ruby@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1 + with: + bundler-cache: true - name: Match advisories env: From ea073390a0f0dd41c1d5a6e3ff6073a5b307dde5 Mon Sep 17 00:00:00 2001 From: Andrew Nesbitt Date: Mon, 3 Aug 2026 11:01:59 +0100 Subject: [PATCH 5/5] ingest.yml: run on ubuntu-latest instead of macOS --- .github/workflows/ingest.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/ingest.yml b/.github/workflows/ingest.yml index 65d4457ec..6743a912a 100644 --- a/.github/workflows/ingest.yml +++ b/.github/workflows/ingest.yml @@ -14,7 +14,7 @@ permissions: jobs: match: if: github.ref == 'refs/heads/main' - runs-on: macos-latest + runs-on: ubuntu-latest # A full --all sweep queries OSV for every homebrew-core formula plus its # distro/registry mappings; the calibration run in Homebrew/brew#23329 hit # ~8.5s/formula, so allow the full 6h.