Trim repology index and filter uncomparable advisories

.github/workflows/ingest.yml

@@ -15,10 +15,10 @@ jobs:
   match:
     if: github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
-    # A full --all sweep queries OSV for every homebrew-core formula plus its
-    # distro/registry mappings; the calibration run in Homebrew/brew#23329 hit
-    # ~8.5s/formula, so allow the full 6h.
-    timeout-minutes: 360
+    # Local Aug 2026 measurement with --no-history and the trimmed
+    # data/repology.json (select_ecosystems + overrides.yml skip applied):
+    # 90820 records in 126.4 min, peak RSS 1.68 GB.
+    timeout-minutes: 180
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
@@ -34,6 +34,9 @@ jobs:
         with:
           bundler-cache: true
 
+      - name: Runner diagnostics
+        run: free -m && df -h
+
       - name: Match advisories
         env:
           HOMEBREW_NO_AUTO_UPDATE: "1"
@@ -46,7 +49,7 @@ jobs:
         # OsvExport.merge_existing regardless. Drop this flag once
         # `brew advisory-match` gains a "walk history only for records not
         # already on disk" mode.
-        run: brew advisory-match --all --output advisories --no-history
+        run: brew advisory-match --all --verbose --output advisories --no-history
 
       - name: Concatenate advisories
         run: rake advisories:concat

Rakefile

@@ -13,6 +13,14 @@ namespace :repology do
     limit = ENV["REPOLOGY_PAGE_LIMIT"]&.to_i
     RepologyIndex.new(page_limit: limit).write("data/repology.json")
   end
+
+  desc "Re-apply select_ecosystems and overrides.yml skips to data/repology.json without re-crawling"
+  task :trim do
+    require_relative "lib/repology_index"
+    result = RepologyIndex.trim("data/repology.json")
+    puts "trimmed to #{result["formulae"].size} formulae, " \
+         "ecosystems: #{result["meta"]["osv_distros"].join(", ")}"
+  end
 end
 
 namespace :advisories do

data/overrides.yml

@@ -0,0 +1,12 @@
+# Per-formula overrides for `brew advisory-match --all`.
+#
+# skip: true excludes the formula from matching entirely. Use this when the
+# formula's upstream identity is correct but the advisories it pulls in do not
+# apply to what Homebrew ships (headers-only, docs-only, data-only packages).
+
+linux-headers@4.4:
+  skip: true
+linux-headers@5.15:
+  skip: true
+linux-headers@6.8:
+  skip: true