feat(ci): add openssl-secjson

[MaineK00n]

What

Wire the new openssl-secjson fetch target (MaineK00n/vuls-data-update#900) into the raw data pipeline.

Added openssl-secjson / vuls-data-raw-openssl-secjson to:

workflow	list
fetch-main.yml	workflow_dispatch target choices
fetch-all.yml	fetch-main matrix
archive.yml, archive-raw.yml	raw archive targets
backup-daily.yml, backup-weekly.yml, backup-monthly.yml	raw backup targets
gc.yml, gc-raw.yml	raw gc targets (pack-threads: 2, pack-windowMemory: 4g)
restore-all.yml	raw restore targets
extract-main.yml, extract-all.yml	commented-out entries only

Why

OpenSSL publishes advisories as MITRE CVE Record Format JSON at https://openssl-library.org/news/secjson/. The new fetcher needs no special handling (no secrets, no args, no restore step), so the generic fetch-main path covers it.

How

Entries are placed alphabetically between openeuler-cvrf and oracle-linux in every list.

The extract-* matrices get a commented-out entry rather than a live one, since no extractor exists for this source yet — matching how other fetch-only sources such as mitre-emb3d and netbsd are recorded. db-main.mk / db-nightly.mk and the diff-guard thresholds are untouched for the same reason.

Testing

• All .github/workflows/*.yml parse (yaml.safe_load)
• fetch-main.yml dispatch choices and the fetch-all.yml matrix stay in sync at 135 entries each, both containing openssl-secjson
• Cross-checked the set of touched files against an existing fetch-only source (mitre-emb3d, netbsd) so no raw-pipeline list is missed
• Not yet exercised on CI — the first Fetch Main run for this target will be the real verification, and it requires the upstream fetcher PR to be merged to nightly first

Checklist

• Entries alphabetically ordered in every list
• YAML valid
• Fetch Main dispatched for openssl-secjson after feat(fetch/openssl/secjson): add OpenSSL security advisory JSON fetcher MaineK00n/vuls-data-update#900 merges

🤖 Generated with Claude Code

[Copilot]

🟢 Ready to approve

The new target is added consistently (and alphabetically) across the intended raw-pipeline workflow lists, with extract entries correctly left commented out to match the stated fetch-only approach.

This review doesn't count toward merge requirements. Sign up for the private preview to control whether Copilot approvals count.

Pull request overview

Wires the new openssl-secjson source into the raw-data GitHub Actions pipeline by adding it to the relevant workflow target lists/matrices, while keeping extraction entries commented out (fetch-only) until an extractor exists.

Changes:

• Added openssl-secjson to fetch-main.yml workflow_dispatch choices and to the fetch-all.yml matrix.
• Added vuls-data-raw-openssl-secjson to raw repo target lists used by archive/backup/restore/gc workflows (including gc-raw.yml pack settings).
• Recorded openssl-secjson as a commented-out entry in extract-main.yml / extract-all.yml to reflect “fetch-only” status.

File summaries

File	Description
.github/workflows/fetch-main.yml	Adds openssl-secjson to dispatch target choices.
.github/workflows/fetch-all.yml	Adds openssl-secjson to the fetch matrix to keep it in sync with dispatch options.
.github/workflows/archive.yml	Adds vuls-data-raw-openssl-secjson to raw archive targets.
.github/workflows/archive-raw.yml	Adds openssl-secjson to the raw-archive source list.
.github/workflows/backup-daily.yml	Adds vuls-data-raw-openssl-secjson to daily raw backup targets.
.github/workflows/backup-weekly.yml	Adds vuls-data-raw-openssl-secjson to weekly raw backup targets.
.github/workflows/backup-monthly.yml	Adds vuls-data-raw-openssl-secjson to monthly raw backup targets.
.github/workflows/restore-all.yml	Adds vuls-data-raw-openssl-secjson to raw restore targets.
.github/workflows/gc.yml	Adds vuls-data-raw-openssl-secjson to raw GC targets.
.github/workflows/gc-raw.yml	Adds vuls-data-raw-openssl-secjson to the GC-raw matrix with pack settings.
.github/workflows/extract-main.yml	Adds a commented-out openssl-secjson entry to reflect fetch-only status.
.github/workflows/extract-all.yml	Adds commented-out openssl-secjson entries in both extract matrices.

Review details

• Files reviewed: 12/12 changed files
• Comments generated: 0
• Review effort level: Low

We're testing this review assessment. Please use 👍 or 👎 to tell us if it's correct.

[shino]

🎃