Ingest #10
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Ingest | |
| on: | |
| schedule: | |
| # Offset from Regenerate (06:20) so that job's PR has typically merged and | |
| # the source: generated records this job must not overwrite are on main. | |
| - cron: "20 8 * * *" | |
| workflow_dispatch: | |
| defaults: | |
| run: | |
| shell: bash -xeuo pipefail {0} | |
| concurrency: | |
| group: ingest | |
| env: | |
| HOMEBREW_DEVELOPER: 1 | |
| HOMEBREW_NO_AUTO_UPDATE: 1 | |
| HOMEBREW_NO_ENV_HINTS: 1 | |
| permissions: {} | |
| jobs: | |
| match: | |
| name: Match advisory candidates | |
| if: github.repository_owner == 'Homebrew' && github.ref == 'refs/heads/main' | |
| runs-on: ubuntu-latest | |
| permissions: | |
| contents: write # Push the bot-owned candidate branch. | |
| pull-requests: write # Open a pull request for that branch. | |
| # Local Aug 2026 measurement with --no-history and the trimmed | |
| # data/repology.json (select_ecosystems + overrides.yml skip applied): | |
| # 90820 records in 126.4 min, peak RSS 1.68 GB. | |
| timeout-minutes: 180 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up Homebrew | |
| uses: Homebrew/actions/setup-homebrew@fd832223f9f99ebf0244dd20658680e5d4aca049 # 2026.08.03.2 | |
| with: | |
| core: true | |
| - name: Set up Ruby | |
| uses: Homebrew/actions/setup-ruby@fd832223f9f99ebf0244dd20658680e5d4aca049 # 2026.08.03.2 | |
| with: | |
| bundler-cache: true | |
| portable-ruby: true | |
| - name: Runner diagnostics | |
| run: free -m && df -h | |
| - name: Match advisories | |
| # Step-scoped: setup-homebrew unsets this so brew install can use the API. | |
| env: | |
| HOMEBREW_NO_INSTALL_FROM_API: 1 | |
| # --no-history: the FormulaVersions walk for every :fixed hit across | |
| # ~8500 formulae would exceed the job limit. New records get | |
| # `fixed: <current pkg_version>` which reviewers tighten per | |
| # CONTRIBUTING; existing records keep their on-disk ranges via | |
| # OsvExport.merge_existing regardless. Drop this flag once | |
| # `brew advisory-match` gains a "walk history only for records not | |
| # already on disk" mode. | |
| run: brew advisory-match --all --verbose --output advisories --no-history | |
| - name: Concatenate advisories | |
| run: bundle exec rake advisories:concat | |
| - name: Configure git | |
| uses: Homebrew/actions/git-user-config@fd832223f9f99ebf0244dd20658680e5d4aca049 # 2026.08.03.2 | |
| with: | |
| username: github-actions[bot] | |
| - name: Commit advisories | |
| id: commit | |
| env: | |
| BRANCH: matched-advisories | |
| run: | | |
| git add advisories/ data/ | |
| if git diff --cached --quiet; then | |
| echo "No changes." | |
| exit 0 | |
| fi | |
| git checkout -b "${BRANCH}" | |
| git commit -m "Matched advisory candidates" | |
| { | |
| echo "branch=${BRANCH}" | |
| echo "committed=true" | |
| } >> "${GITHUB_OUTPUT}" | |
| - name: Push commits | |
| if: steps.commit.outputs.committed == 'true' | |
| uses: Homebrew/actions/git-try-push@fd832223f9f99ebf0244dd20658680e5d4aca049 # 2026.08.03.2 | |
| with: | |
| token: ${{ github.token }} | |
| branch: ${{ steps.commit.outputs.branch }} | |
| # No lease: rebuilt from main each run, and no remote-tracking ref exists. | |
| force: true | |
| no_lease: true | |
| origin_branch: HEAD | |
| - name: Open pull request | |
| if: steps.commit.outputs.committed == 'true' | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| BRANCH: ${{ steps.commit.outputs.branch }} | |
| run: | | |
| open_pr_number="$(gh pr list --head "${BRANCH}" --state open \ | |
| --json number,isCrossRepository \ | |
| --jq '.[] | select(.isCrossRepository | not) | .number')" | |
| if [[ -n "${open_pr_number}" ]]; then | |
| echo "PR already open." | |
| else | |
| gh pr create --base main --head "${BRANCH}" \ | |
| --title "Matched advisory candidates" \ | |
| --body "Automated candidates via \`brew advisory-match --all\`. See [CONTRIBUTING.md](https://github.com/${GITHUB_REPOSITORY}/blob/HEAD/CONTRIBUTING.md#reviewing-matched-candidates) for the review checklist." | |
| fi |