RepologyIndex: index sibling-formula projects; run tests on PRs - #27
Merged
Conversation
A Repology project that groups Homebrew formulae with distinct base names (wget + wget2, sqlite + sqlite-analyzer, boost + boost-mpi, ffmpeg + a third-party ffmpeg-full) was previously omitted from the index and recorded only in meta.ambiguous_projects. That left 50 projects unmapped, including several heavy-CVE targets (ffmpeg, imagemagick, wget, sqlite, binutils, openssl variants). Each formula in such a project is now indexed with the full distro srcname set. In Homebrew::Vulns::Match the sibling's srcnames become extra low-confidence distro queries whose upstream-CVE range check will not match this formula's identity, so the cost is uncomparable candidate records rather than wrong :affected/:fixed claims. meta.ambiguous_projects is still populated so the set can be tightened via repology-rules PRs.
regenerate.yml runs the test suite before rebuilding the index, but only on schedule; PRs touching lib/ or test/ had no test coverage. Add a test job mirroring regenerate.yml's Ruby setup.
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the Repology indexing logic to include “sibling-formula” Repology projects (where multiple Homebrew formulae share a Repology project despite distinct base names) while still recording them as ambiguous, and expands CI validation by running Ruby tests on PRs.
Changes:
- Index sibling-formula Repology projects instead of omitting them, while continuing to record them in
meta.ambiguous_projects. - Update Repology index tests to validate the new indexing behavior for sibling-formula projects.
- Add a
testjob tovalidate.ymlto runrake teston pushes and pull requests.
Reviewed changes
Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.
| File | Description |
|---|---|
lib/repology_index.rb |
Loosens ambiguous-project handling to index sibling-formula projects and updates logging/documentation. |
test/repology_index_test.rb |
Adjusts expectations to cover sibling-formula indexing and updated logging behavior. |
.github/workflows/validate.yml |
Adds a PR-running Ruby test job mirroring the regenerate workflow’s Ruby setup. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
p-linnane
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two changes surfaced by the
brew advisory-matchcalibration run in Homebrew/brew#23329.RepologyIndex sibling-formula loosening. A Repology project that groups Homebrew formulae with distinct base names (
wget+wget2,sqlite+sqlite-analyzer,boost+boost-mpi,ffmpeg+ a third-partyffmpeg-full) was previously omitted fromdata/repology.jsonand recorded only inmeta.ambiguous_projects. That left 50 projects unmapped, includingffmpeg,imagemagick,wget,sqlite,binutilsandcmake. Each formula in such a project is now indexed with the full distro srcname set; inHomebrew::Vulns::Match(Homebrew/brew#23329) the sibling's srcnames become extra low-confidence distro queries whose upstream-CVE range check will not match this formula's identity, so the cost is uncomparable candidate records rather than wrong:affected/:fixedclaims.meta.ambiguous_projectsis still populated so the list can be tightened via repology-rules PRs.validate.ymltest job.regenerate.ymlrunsrake testbefore rebuilding the index, but only on schedule; PRs touchinglib/ortest/had no coverage. Added atestjob mirroringregenerate.yml's Ruby setup. RuboCop is not added because the org-synced.rubocop.ymlsetsAllCops: Include: ["**/*.rbi"], which replaces the default.rbglob and scans nothing here (aHomebrew/.githubfix).