vulns/osv_export: merge into existing records instead of overwriting

[andrew]

Follow-up to #23106 so Homebrew/homebrew-advisory-database can be an accumulating source of truth rather than a daily snapshot (per the outcome of Homebrew/homebrew-brew-vulns#111).

OsvExport.run now merges into the target directory instead of blindly writing. For each generated record, if an <id>.json already exists its published timestamp and affected[].ranges are carried forward, so the fixed boundary reflects when the annotation was first observed rather than drifting to today's pkg_version on every run; the write is skipped entirely when nothing else has changed. Records for annotations no longer in homebrew/core are simply not visited, so they persist on the default branch. Curated records (which use a different id shape) are never touched.

Because ranges is preserved from disk, a hand-corrected fixed boundary (e.g. backdating libquicktime to _4) survives subsequent runs. A transient OSV.dev failure leaves an existing enriched record untouched rather than stripping its summary/severity/references; a new record with no existing file is still written without enrichment. The unchanged comparison uses parsed hashes so key ordering in a hand-formatted file does not cause spurious rewrites.

Records also gain published and database_specific: {source: "generated"} per the draft CONTRIBUTING.md in Homebrew/advisory-database#3. regenerate.yml in that repo drops its rm -f advisories/*.json in Homebrew/advisory-database#2.

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

Written with Claude Code following the discussion on Homebrew/homebrew-brew-vulns#111 and Homebrew/discussions#6869, with a codex review pass that caught the transient-outage stripping and key-order comparison issues. I read the diff and ran brew lgtm locally.

---

[Copilot]

Pull request overview

This PR updates Homebrew’s OSV advisory exporter (Homebrew::Vulns::OsvExport) so it merges generated advisories into an existing target directory rather than overwriting, enabling the advisory database to accumulate records over time while preserving key historical fields.

Changes:

• Preserve existing on-disk published (when present) and affected[].ranges while regenerating records, and skip rewrites when the record is otherwise unchanged.
• Avoid stripping previously-enriched fields when the upstream OSV API fetch fails (leave existing enriched records untouched).
• Add published plus database_specific: { source: "generated" } to generated records, and extend specs to cover merge/no-rewrite behavior and upstream outage behavior.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
Library/Homebrew/vulns/osv_export.rb	Implement merge-in-place behavior, upstream-outage handling, and add published/database_specific fields.
Library/Homebrew/test/vulns/osv_export_spec.rb	Add/adjust tests for the new merge semantics, non-rewrite comparisons, and upstream failure scenarios.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.