feat: add OSV IOC candidate pipeline scaffold

Author: brian93512

.github/workflows/ioc-candidates.yml

@@ -0,0 +1,69 @@
+name: IOC Candidate Monitor
+
+on:
+  schedule:
+    - cron: "15 10 * * *"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  generate-candidates:
+    name: Generate OSV blacklist candidates
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Go
+        uses: actions/setup-go@v5
+        with:
+          go-version-file: go.mod
+
+      - name: Fetch IOC candidates
+        run: |
+          go run ./scripts/ioc-candidates \
+            -since 24h \
+            -min-severity HIGH \
+            -ecosystems npm,PyPI,Go \
+            -out /tmp/candidates.json \
+            -existing pkg/analyzer/data/blacklist.json
+
+      - name: Count candidates
+        id: candidate_count
+        run: |
+          count="$(jq 'length' /tmp/candidates.json)"
+          echo "count=$count" >> "$GITHUB_OUTPUT"
+
+      - name: Merge candidates into blacklist
+        if: steps.candidate_count.outputs.count != '0'
+        run: |
+          jq -s '
+            (.[0] + .[1])
+            | unique_by("\(.ecosystem)|\(.component)|\(.affected_versions | join(","))")
+            | sort_by(.ecosystem, .component)
+          ' pkg/analyzer/data/blacklist.json /tmp/candidates.json > /tmp/merged-blacklist.json
+          mv /tmp/merged-blacklist.json pkg/analyzer/data/blacklist.json
+
+      - name: Create pull request
+        if: steps.candidate_count.outputs.count != '0'
+        uses: peter-evans/create-pull-request@v7
+        with:
+          token: ${{ secrets.TOOLTRUST_BOT_TOKEN || github.token }}
+          branch: ioc-candidates/${{ github.run_id }}
+          title: "ioc: ${{ steps.candidate_count.outputs.count }} new blacklist candidate(s)"
+          commit-message: "data(blacklist): auto-append ${{ steps.candidate_count.outputs.count }} OSV candidate(s)"
+          body: |
+            Automated IOC blacklist candidates generated from OSV ecosystem feeds for the last 24 hours.
+
+            Review each entry carefully:
+            - Is the version pinning exact and narrow enough?
+            - Is `BLOCK` the right action, or should this be downgraded to `WARN`?
+            - Is the reason clear enough for someone triaging a finding?
+
+            Close this PR if any candidate looks incorrect. The workflow will retry on the next scheduled run.
+          labels: |
+            ioc
+            automated

docs/ioc-pipeline.md

@@ -0,0 +1,56 @@
+# IOC Blacklist Auto-Candidate Pipeline
+
+This workflow adds a daily review loop for likely blacklist entries without silently editing the live scanner data.
+
+## What it does
+
+- pulls recent OSV ecosystem advisories for `npm`, `PyPI`, and `Go`
+- filters to advisories published in the last 24 hours
+- keeps only `HIGH` and `CRITICAL` candidates
+- skips package versions already present in [`pkg/analyzer/data/blacklist.json`](/Users/brian93512/projects/tooltrust-scanner/pkg/analyzer/data/blacklist.json)
+- opens one review PR with candidate blacklist entries
+
+The workflow never auto-merges. A human still decides whether a candidate belongs in the enforced blacklist.
+
+## Why this exists
+
+Our blacklist is strong once an entry exists, but hand-editing it means we can lag major supply-chain events by hours. This pipeline narrows that gap by surfacing review-ready candidates quickly after OSV publishes an advisory.
+
+## Review checklist
+
+When the workflow opens a PR:
+
+1. confirm the affected versions are exact and narrow enough
+2. confirm `BLOCK` is the correct action
+3. rewrite the reason if the current summary is too vague for triage
+4. close the PR if the advisory is too broad, too noisy, or otherwise not suitable for blacklist enforcement
+
+## Local dry run
+
+```bash
+go run ./scripts/ioc-candidates \
+  -since 720h \
+  -min-severity HIGH \
+  -ecosystems npm,PyPI,Go \
+  -out /tmp/candidates.json \
+  -existing pkg/analyzer/data/blacklist.json
+```
+
+That gives us a 30-day sample so we can inspect candidate quality before relying on the scheduled workflow.
+
+## Failure behavior
+
+- transient OSV fetch failures log a warning and produce an empty candidate set
+- the workflow does not fail `main` because an upstream feed had a bad day
+- a no-op day simply means no PR is opened
+
+## Scope
+
+This is intentionally narrow:
+
+- it only proposes additions to the blacklist
+- it does not auto-remove entries
+- it does not cover pre-advisory blog posts or social-media disclosures
+- it does not replace the existing threat-intel issue workflow
+
+Those are follow-ups once candidate quality is stable.