feat(recoverer): migrate recoverer daemon to Go

AGENTS.md

@@ -220,9 +220,14 @@ All Go microservices are compiled using a single, unified multi-target Dockerfil
    - Git client daemon/utility to precompute and cache git operations required by other services.
    - Performs intensive Git tasks like computing commit graphs and generating patch IDs.
 
+8. **`recoverer`**:
+   - Daemon that subscribes to failed task recovery Pub/Sub messages.
+   - Repairs and retries failed GCS writes, reimports missing vulnerability records from sources (via Gitter, GCS bucket, or REST), and handles GCS generation mismatches.
+
 ### Internal Shared Libraries (`go/internal/`)
 - **`api/`**: Shared package containing the core gRPC public server implementation of the OSV API.
 - **`worker/`**: Core engine and subscriber logic for the Go worker.
+- **`recoverer/`**: Core engine and handlers for the Go recoverer.
 - **`database/`**: Shared Datastore client and repository models (specifically [`go/internal/database/datastore/`](go/internal/database/datastore/)).
   - *Design Pattern*: Models here **mirror** the Datastore models defined in the Python library ([`osv/models.py`](osv/models.py)).
   - *Consistency Testing*: To prevent synchronization drift between Go and Python database models, a database validation test is maintained under [`go/internal/database/datastore/internal/validate/`](go/internal/database/datastore/internal/validate/) (run via `run_validate.sh`).
@@ -258,14 +263,14 @@ Contains deployment setups, workers running in GKE, Cloud Functions, and the use
 - **Deployment Target**: **Google Cloud Run** (managed via Cloud Deploy pipeline `osv-website`).
 
 ### 3. Workers (`gcp/workers/`)
-- **`worker` (`gcp/workers/worker/`)**: **Base Environment**. Retains shared Poetry dependencies and base Dockerfile for Python workers (`recoverer`, `vanir_signatures`); legacy worker daemon replaced by Go worker under `go/cmd/worker/`.
+- **`worker` (`gcp/workers/worker/`)**: **Base Environment**. Retains shared Poetry dependencies and base Dockerfile for Python workers (`vanir_signatures`); legacy worker daemon replaced by Go worker under `go/cmd/worker/`.
 - **ClusterFuzz Worker (`gcp/workers/oss_fuzz_worker/`, `gcp/workers/oss_fuzz_importer/`)**: **Barely Maintained**. Siloed workloads for OSS-Fuzz integration.
   - **Deployment Target**: **GKE** (managed via Cloud Deploy pipeline `oss-fuzz-workers`).
 - **`vanir_signatures`**: **Active (Python)**. Used for signature generation/verification.
-- **`recoverer`**: **Active (Python)**. Used to recover/repair states; scheduled for migration to Go in the future.
 
 ### 4. Indexer (`gcp/indexer/`)
 - **Status**: **Active (Go)**.
 - Handles indexing, but is not under active development.
 - **Deployment Target**: **GKE** (managed via Cloud Deploy pipeline `gke-indexer`).
 
+

Makefile

@@ -18,9 +18,6 @@ run-cmd := poetry run
 lib-tests: ## Run core Python library tests
 	./run_tests.sh
 
-recoverer-tests: ## Run Python recoverer tests
-	cd gcp/workers/recoverer && ./run_tests.sh
-
 vanir-signatures-tests: ## Run Vanir signatures tests
 	cd gcp/workers/vanir_signatures && ./run_tests.sh
 
@@ -123,7 +120,7 @@ run-api-server-test:
 	@cd go && go build -o ./api-devserver ./cmd/api-devserver && (GOOGLE_CLOUD_PROJECT=oss-vdb-test OSV_VULNERABILITIES_BUCKET=osv-test-vulnerabilities ./api-devserver $(ARGS); EXIT_CODE=$$?; rm -f ./api-devserver; exit $$EXIT_CODE)
 
 # TODO: API integration tests.
-all-tests: lib-tests recoverer-tests website-tests vulnfeed-tests bindings-tests go-tests ## Run all tests
+all-tests: lib-tests website-tests vulnfeed-tests bindings-tests go-tests ## Run all tests
 
 reimport-tui: ## Run the reimport TUI tool
 	test -f $(HOME)/.config/gcloud/application_default_credentials.json || (echo "GCP Application Default Credentials not set, try 'gcloud auth application-default login'"; exit 1)

README.md

@@ -44,8 +44,8 @@ consists of:
 | `gcp/functions` | The Cloud Function for publishing PyPI vulnerabilities (maintained, but not developed) |
 | `gcp/indexer`   | The determine version `indexer` |
 | `gcp/website`   | The backend of the osv.dev web interface, with the frontend in `frontend3` <br /> Blog posts (in `blog`) |
-| `gcp/workers/`  | Python workers (`recoverer`, `vanir_signatures`, and `oss_fuzz_worker`) |
-| `go/`           | Go module for shared libraries and commands (`cmd/exporter`, `cmd/recordchecker`) |
+| `gcp/workers/`  | Python workers (`vanir_signatures` and `oss_fuzz_worker`) |
+| `go/`           | Go module for shared libraries and commands (`cmd/api`, `cmd/importer`, `cmd/worker`, `cmd/exporter`, `cmd/recoverer`, `cmd/relations`, etc.) |
 | `osv/`          | The core OSV Python library, used in basically all Python services <br /> OSV ecosystem package versioning helpers in `ecosystems/` <br /> Datastore model definitions in `models.py` |
 | `tools/`        | Misc scripts/tools, mostly intended for development (datastore stuff, linting) <br /> The `indexer-api-caller` for indexer calling |
 | `vulnfeeds/`    | Go module for (mostly) the NVD CVE conversion <br /> The Alpine feed converter (`cmd/alpine`) <br /> The Debian feed converter (`tools/debian`, which is written in Python) |

deployment/build-and-stage.yaml

@@ -62,7 +62,7 @@ steps:
   args: ['push', '--all-tags', 'gcr.io/oss-vdb/worker-base']
   waitFor: ['build-worker-base', 'cloud-build-queue']
 
-# Build/push core worker/recoverer images.
+# Build/push core worker images.
 - name: gcr.io/cloud-builders/docker
   args: ['build', '-t', 'gcr.io/oss-vdb/worker:latest', '-t', 'gcr.io/oss-vdb/worker:$COMMIT_SHA', '-f', 'gcp/workers/worker/Dockerfile', '.']
   id: 'build-worker'
@@ -71,15 +71,6 @@ steps:
   args: ['push', '--all-tags', 'gcr.io/oss-vdb/worker']
   waitFor: ['build-worker', 'cloud-build-queue']
 
-- name: gcr.io/cloud-builders/docker
-  args: ['build', '-t', 'gcr.io/oss-vdb/recoverer:latest', '-t', 'gcr.io/oss-vdb/recoverer:$COMMIT_SHA', '.']
-  dir: 'gcp/workers/recoverer'
-  id: 'build-recoverer'
-  waitFor: ['build-worker']
-- name: gcr.io/cloud-builders/docker
-  args: ['push', '--all-tags', 'gcr.io/oss-vdb/recoverer']
-  waitFor: ['build-recoverer', 'cloud-build-queue']
-
 - name: gcr.io/cloud-builders/docker
   args: ['build', '-t', 'gcr.io/oss-vdb/oss-fuzz-worker:latest', '-t', 'gcr.io/oss-vdb/oss-fuzz-worker:$COMMIT_SHA', '-f', 'gcp/workers/oss_fuzz_worker/Dockerfile', '.']
   id: 'build-oss-fuzz-worker'
@@ -224,6 +215,20 @@ steps:
   args: ['push', '--all-tags', 'gcr.io/oss-vdb/osv-server']
   waitFor: ['build-osv-server', 'cloud-build-queue']
 
+- name: 'gcr.io/cloud-builders/docker'
+  entrypoint: 'bash'
+  args: ['-c', 'docker pull gcr.io/oss-vdb/recoverer:latest || exit 0']
+  id: 'pull-recoverer'
+  waitFor: ['setup']
+- name: gcr.io/cloud-builders/docker
+  args: ['buildx', 'build', '-t', 'gcr.io/oss-vdb/recoverer:latest', '-t', 'gcr.io/oss-vdb/recoverer:$COMMIT_SHA', '--target', 'recoverer', '--build-context', 'bindings=../bindings', '-f', 'Dockerfile', '--cache-from', 'gcr.io/oss-vdb/recoverer:latest', '--pull', '.']
+  dir: 'go'
+  id: 'build-recoverer'
+  waitFor: ['pull-recoverer', 'build-osv-server']
+- name: gcr.io/cloud-builders/docker
+  args: ['push', '--all-tags', 'gcr.io/oss-vdb/recoverer']
+  waitFor: ['build-recoverer', 'cloud-build-queue']
+
 # Build/push staging-api-test images to gcr.io/oss-vdb-test.
 - name: gcr.io/cloud-builders/docker
   args: ['build', '-t', 'gcr.io/oss-vdb-test/staging-api-test:latest', '-t', 'gcr.io/oss-vdb-test/staging-api-test:$COMMIT_SHA', '.']

deployment/clouddeploy/gke-workers/base/core/recoverer.yaml

@@ -30,11 +30,15 @@ spec:
       - name: recoverer
         image: recoverer
         imagePullPolicy: Always
-      resources:
-        requests:
-          cpu: "10m"
-          memory: "256Mi"
-        limits:
-          cpu: "200m"
-          memory: "512Mi"
+        env:
+          - name: GITTER_HOST
+            value: http://gitter-service:8888
+        resources:
+          requests:
+            cpu: "10m"
+            memory: "256Mi"
+          limits:
+            cpu: "200m"
+            memory: "512Mi"
+
 

gcp/workers/cloudbuild.yaml

@@ -33,14 +33,6 @@ steps:
   args: ['poetry', 'sync']
   waitFor: ['-']
 
-- name: 'gcr.io/oss-vdb/ci'
-  id: 'recoverer-tests'
-  dir: gcp/workers/recoverer
-  args: ['bash', '-ex', 'run_tests.sh']
-  env:
-    - DATASTORE_EMULATOR_PORT=8005
-    - GITTER_PORT=8891
-  waitFor: ['init', 'sync']
 
 - name: 'gcr.io/oss-vdb/ci'
   id: 'vanir-signatures-tests'