Add Ingest workflow: nightly brew advisory-match --all - #29
Draft
andrew wants to merge 3 commits into
Draft
Conversation
Runs brew advisory-match --all --output advisories --no-history at 08:20 UTC (offset from Regenerate at 06:20 so that job's source: generated records are on main and get skipped rather than overwritten) and opens a matched-advisories PR when anything changes. --no-history is used because the FormulaVersions walk for every :fixed hit across ~8500 formulae would exceed the job limit; new records get fixed: <current pkg_version> which reviewers tighten per CONTRIBUTING, and existing records keep their on-disk ranges via merge_existing. Merge only after Homebrew/brew#23329 ships in a tagged release.
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new scheduled GitHub Actions workflow to run Homebrew’s advisory matching nightly and open/update a dedicated PR with any resulting advisory changes.
Changes:
- Introduces
.github/workflows/ingest.ymlscheduled at 08:20 UTC (offset fromRegenerate) with a 6-hour timeout. - Runs
brew advisory-match --all --output advisories --no-historyand force-pushes updates to amatched-advisoriesbranch. - Creates a PR titled “Matched advisory candidates” when changes are detected.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
You may want to mark this PR as draft just in case someone misses that. |
andrew
marked this pull request as draft
July 29, 2026 11:04
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Nightly job that runs
brew advisory-match --all --output advisories --no-historyand opens amatched-advisoriesPR when anything changes. Scheduled at 08:20 UTC, two hours afterRegenerate, so that job'ssource: generatedrecords are onmainand get skipped by--outputrather than overwritten.--no-historybecause theFormulaVersionswalk for every:fixedhit across ~8,500 formulae would exceed the 6h job limit. New records get"fixed": "<current pkg_version>"which reviewers tighten per CONTRIBUTING (#28); existing records keep their on-diskrangesviaOsvExport.merge_existingregardless. The flag can go oncebrew advisory-matchskips the walk for records already on disk.Do not merge before Homebrew/brew#23329 ships in a tagged release (expected next Monday); the
brew advisory-matchcommand doesn't exist in the current release. Draft until then.Depends on #28 for the CONTRIBUTING anchor the PR body links to; independent of #27 (though both improve what this job produces).