Filter uncomparable and rejected matched candidates - #116
Merged
Conversation
Drop from each Ingest run's fresh `brew advisory-match` output:
- Uncomparable candidates (`source: matched`, no `range_state`): their
`{introduced: "0"}` range with no `fixed` event reads as every version
being affected in raw OSV, so they are discarded until the matcher can
emit a shape that does not assert a range.
- Ids in data/rejected-candidates.txt: each run re-derives every match
from scratch, so a rejected candidate would otherwise be re-proposed.
Only untracked paths are deleted. A tracked matched record that is
uncomparable or denylisted fails the run, as does a missing denylist.
Signed-off-by: Patrick Linnane <patrick@linnane.io>
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new “filter” stage to the ingest pipeline so fresh brew advisory-match output is cleaned (uncomparable + reviewer-rejected candidates removed) before snapshotting/sharding, with CI/spec coverage to keep workflow ordering stable.
Changes:
- Introduce
AdvisoryFilterand arake advisories:filtertask to drop uncomparable matched candidates and denylisted IDs, while failing if tracked records violate the policy. - Wire the filter step into
.github/workflows/ingest.ymlbetween matching and snapshotting, and add a workflow spec asserting the step ordering and commands. - Add a durable denylist file plus CONTRIBUTING guidance on rejection behavior, and add unit tests for filtering/denylist parsing.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
| spec/workflows_spec.rb | Asserts the new ingest filter step exists and is ordered between match and snapshot. |
| spec/advisory_filter_spec.rb | New unit tests for uncomparable/denylisted filtering rules and denylist parsing. |
| Rakefile | Adds advisories:filter task to run the filter over NUL-delimited untracked paths. |
| lib/advisory_filter.rb | Implements matched-candidate filtering + tracked-record policy enforcement. |
| data/rejected-candidates.txt | Adds the durable denylist file referenced by the filter and docs. |
| CONTRIBUTING.md | Documents the comparable-only behavior and how to durably reject candidates. |
| .github/workflows/ingest.yml | Inserts the filter step into the ingest workflow before snapshot/shard steps. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
andrew
approved these changes
Aug 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Drops uncomparable matched candidates and reviewer-rejected ids from each Ingest run's fresh output before sharding, failing the run if a tracked record loses its comparable range or the denylist is missing. Details in the commit message.
Groundwork for the #52–#115 backfill: once this lands, the shard branches can be rebuilt comparable-only from the new main.