Publish data/advisories.json indexed by formula name

[andrew]

Concatenates every advisories/*.json record into data/advisories.json, grouped by affected[0].package.name and sorted by id, so consumers can fetch the whole corpus in one request. Shape:

{
  "meta": {"count": N, "schema_version": "..."},
  "advisories": {"<formula>": [{<record>}, ...], ...}
}

rake advisories:concat builds it; regenerate.yml runs it after brew generate-vulns-advisories and the existing git add advisories/ data/ picks it up. The initial file (44 records, 10 formulae, ~150KB) is committed so https://raw.githubusercontent.com/Homebrew/advisory-database/main/data/advisories.json is live on merge.

This unblocks the generate-formula-api change in Homebrew/brew that reads this file (instead of querying OSV live per API build) and attaches a vulnerabilities field to each formula's API JSON. #29 will need the same rake advisories:concat step before its git add; happy to add that here or on #29's branch.

[Copilot]

Pull request overview

Adds a generated, formula-indexed advisory corpus file (data/advisories.json) and automation to keep it up-to-date, enabling consumers (notably Homebrew/brew) to fetch advisory data in a single request rather than per-record lookups.

Changes:

• Introduces AdvisoryIndex to concatenate advisories/*.json into data/advisories.json, grouped by formula and sorted deterministically.
• Adds rake advisories:concat and wires it into the existing Regenerate workflow.
• Adds a test suite covering grouping/sorting, error handling, and output formatting for the new index.

Reviewed changes

Copilot reviewed 4 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
lib/advisory_index.rb	Implements the build/write logic for the new formula-indexed advisory JSON output.
Rakefile	Adds advisories:concat task to generate/update data/advisories.json.
.github/workflows/regenerate.yml	Runs the new concat rake task after regenerating advisory records.
test/advisory_index_test.rb	Adds coverage for AdvisoryIndex behavior and output format.
data/advisories.json	Commits the initial generated corpus so it’s immediately available to consumers post-merge.

Comments suppressed due to low confidence (1)

lib/advisory_index.rb:43

• schema_versions.compact.max compares schema versions as plain strings, which can pick the wrong “highest” version lexicographically (e.g. "1.10.0" sorts before "1.9.0"). Use Gem::Version for numeric semantic version comparison and then convert back to a string for the JSON output.

    {
      "meta"       => {
        "count"          => by_formula.each_value.sum(&:size),
        "schema_version" => schema_versions.compact.max,
      },
      "advisories" => by_formula.transform_values { |records| records.sort_by { |r| r.fetch("id") } }
                                .sort.to_h,
    }

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[kmarekspartz]

No strong opinions here, just thought I'd take a look since you've been a great feedback provider!

[kmarekspartz]

I assume this will be fine, but there's a risk of schema conflicts here.

[kmarekspartz]

Potential workaround: group_by schema_version

[kmarekspartz]

Note that the overall brew project moved from Minitest to RSpec about a decade ago: https://github.com/Homebrew/brew.sh/blob/2853c2fbb8fe69d5b2211a4d1525d5b95ffbcc99/_posts/2017-05-01-homebrew-1.2.0.md?plain=1#L42

ruby-macho also uses Minitest, but beyond that, there seems to be more momentum around RSpec.