Add Ingest workflow: nightly brew advisory-match --all

.github/workflows/ingest.yml

@@ -0,0 +1,74 @@
+name: Ingest
+
+on:
+  schedule:
+    # Offset from Regenerate (06:20) so that job's PR has typically merged and
+    # the source: generated records this job must not overwrite are on main.
+    - cron: "20 8 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  match:
+    if: github.ref == 'refs/heads/main'
+    runs-on: ubuntu-latest
+    # A full --all sweep queries OSV for every homebrew-core formula plus its
+    # distro/registry mappings; the calibration run in Homebrew/brew#23329 hit
+    # ~8.5s/formula, so allow the full 6h.
+    timeout-minutes: 360
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1
+
+      - name: Set up Ruby
+        uses: Homebrew/actions/setup-ruby@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1
+        with:
+          bundler-cache: true
+
+      - name: Match advisories
+        env:
+          HOMEBREW_NO_AUTO_UPDATE: "1"
+          HOMEBREW_NO_INSTALL_FROM_API: "1"
+          HOMEBREW_DEVELOPER: "1"
+        # --no-history: the FormulaVersions walk for every :fixed hit across
+        # ~8500 formulae would exceed the job limit. New records get
+        # `fixed: <current pkg_version>` which reviewers tighten per
+        # CONTRIBUTING; existing records keep their on-disk ranges via
+        # OsvExport.merge_existing regardless. Drop this flag once
+        # `brew advisory-match` gains a "walk history only for records not
+        # already on disk" mode.
+        run: brew advisory-match --all --output advisories --no-history
+
+      - name: Concatenate advisories
+        run: rake advisories:concat
+
+      - name: Open pull request
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+          BRANCH: matched-advisories
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+          git add advisories/ data/
+          if git diff --cached --quiet; then
+            echo "No changes."
+            exit 0
+          fi
+          gh auth setup-git --hostname github.com --force
+          git checkout -b "$BRANCH"
+          git commit -m "Matched advisory candidates"
+          git push --force origin "HEAD:refs/heads/$BRANCH"
+          if [ -n "$(gh pr list --head "$BRANCH" --state open --json number --jq '.[].number')" ]; then
+            echo "PR already open."
+          else
+            gh pr create --base main --head "$BRANCH" \
+              --title "Matched advisory candidates" \
+              --body "Automated candidates via \`brew advisory-match --all\`. See [CONTRIBUTING.md](https://github.com/${GITHUB_REPOSITORY}/blob/HEAD/CONTRIBUTING.md#reviewing-matched-candidates) for the review checklist."
+          fi