refactor: convert osv-sync from standalone bin to Temporal workflow

ADR-0001 §Worker architecture (decided 2026-05-25) standardized
packages_worker sub-workers on the Temporal shape: workflows.ts +
activities.ts + schedule.ts per sub-worker, registered against the
shared packages-worker task queue, with ScheduleOverlapPolicy.SKIP
so a slow run does not queue a second concurrent execution.

This branch originally implemented osv-sync as a standalone bin
following the github-repos-enricher precedent and proposed ADR-0004
to codify that pattern. Rebasing onto current main surfaced the
conflict: github-repos-enricher is now explicitly listed as a
legacy exception with migration deferred, and osv/ is named
alongside npm/ and deps-dev/ as Temporal-based from the start.
ADR-0004 is removed (superseded by ADR-0001 before merging).

Changes:

- src/osv/workflows.ts: osvSync workflow definition. Loops the
  ecosystems passed via schedule args, calls osvSyncEcosystem
  activity per ecosystem (per-ecosystem failure logged but does not
  abort the pass), then osvDeriveCriticalFlag. proxyActivities with
  retry policy (3 attempts, exp backoff) and nonRetryableErrorTypes
  for NOT_FOUND / PARSE.
- src/osv/activities.ts: osvSyncEcosystem and osvDeriveCriticalFlag
  activities wrapping the existing pure-function pipeline
  (fetchEcosystemZip + parseOsvRecord + upsertAdvisoryBatch +
  deriveCriticalFlag). Heartbeats every 1000 records keep Temporal
  aware during the ~1-hour npm pass. FetchError(NOT_FOUND|PARSE) is
  translated to ApplicationFailure.nonRetryable so RetryPolicy
  short-circuits.
- src/osv/schedule.ts: scheduleOsvSync registers an idempotent
  daily schedule at 03:30 UTC (offset from npm-registry-ingest at
  03:15). 4-hour workflowExecutionTimeout, SKIP overlap.
- src/workflows/index.ts + src/activities.ts: re-export the new
  workflow + activities for the worker bundle / runtime.
- src/bin/packages-worker.ts: call scheduleOsvSync on startup
  alongside scheduleNpmIngest.

Deleted:
- src/bin/osv-sync.ts (entry point no longer needed)
- src/osv/index.ts (runOsvSync sleep loop replaced by Temporal)
- scripts/services/osv-sync.yaml (separate compose service gone;
  packages-worker container serves osv via the shared task queue)
- docs/adr/0004 (superseded by ADR-0001 §Worker architecture)

Env vars no longer needed (replaced by Temporal scheduling):
- OSV_SYNC_INTERVAL_HOURS (cron expression owns cadence)
- OSV_IDLE_SLEEP_SEC (no internal sleep loop)
- getOsvConfig() removed from src/config.ts

The pure-function pipeline survives untouched — extractSeverity,
cvssScoring, parseOsvRecord, fetchEcosystemZip, upsertAdvisory,
deriveCriticalFlag, versionCompare, types. All 68 unit tests still
pass. The Temporal activity is a thin orchestrator over the same
functions, so the migration is shape-only — no business logic
changes.

Signed-off-by: Joan Reyero <joan@reyero.io>

Author: joanreyero

backend/.env.dist.local

@@ -184,11 +184,9 @@ ENRICHER_BATCH_SIZE=100
 ENRICHER_REPO_UPDATE_INTERVAL_HOURS=24
 ENRICHER_IDLE_SLEEP_SEC=60
 
-# osv-sync
+# osv-sync (Temporal-scheduled; see services/apps/packages_worker/src/osv/schedule.ts)
 OSV_BULK_BASE_URL=https://osv-vulnerabilities.storage.googleapis.com
 OSV_ECOSYSTEMS=npm,Maven
-OSV_SYNC_INTERVAL_HOURS=24
-OSV_IDLE_SLEEP_SEC=60
 OSV_TMP_DIR=/tmp/osv
 OSV_BATCH_SIZE=500
 OSV_DERIVE_BATCH_SIZE=1000

docs/adr/0004-standalone-bin-vs-temporal-for-batch-sub-workers.md

@@ -6,17 +6,17 @@ Use the `/adr` skill in Claude Code to record new ADRs or query past decisions.
 
 ## Index
 
-| ADR | Title | Status | Date |
-| --- | ----- | ------ | ---- |
-| [ADR-0001](./0001-oss-packages-design-decisions.md) | OSS packages — design decisions (living) | living | 2026-05-27 |
-| [ADR-0003](./0003-has-critical-vulnerability-semantics.md) | Semantics of `packages.has_critical_vulnerability` | accepted | 2026-05-27 |
-| [ADR-0004](./0004-standalone-bin-vs-temporal-for-batch-sub-workers.md) | Standalone bin vs Temporal for batch sub-workers in packages_worker | accepted | 2026-05-27 |
-| [ADR-0005](./0005-cvss-scoring-strategy.md) | CVSS scoring strategy for OSV ingestion (inline v3.1, defer v4) | accepted | 2026-05-27 |
-| [ADR-0006](./0006-advisory-affected-ranges-uniqueness-scope.md) | Uniqueness scope of `advisory_affected_ranges` | accepted | 2026-05-27 |
+| ADR                                                             | Title                                                           | Status   | Date       |
+| --------------------------------------------------------------- | --------------------------------------------------------------- | -------- | ---------- |
+| [ADR-0001](./0001-oss-packages-design-decisions.md)             | OSS packages — design decisions (living)                        | living   | 2026-05-27 |
+| [ADR-0003](./0003-has-critical-vulnerability-semantics.md)      | Semantics of `packages.has_critical_vulnerability`              | accepted | 2026-05-27 |
+| [ADR-0005](./0005-cvss-scoring-strategy.md)                     | CVSS scoring strategy for OSV ingestion (inline v3.1, defer v4) | accepted | 2026-05-27 |
+| [ADR-0006](./0006-advisory-affected-ranges-uniqueness-scope.md) | Uniqueness scope of `advisory_affected_ranges`                  | accepted | 2026-05-27 |
 
 ## Why ADRs?
 
 The codebase is in active transition across several axes (see `CLAUDE.md`). ADRs provide a durable record of:
+
 - Why old patterns are being replaced (e.g. Sequelize → pg-promise)
 - What alternatives were considered before choosing the current approach
 - What trade-offs were accepted

docs/adr/README.md

@@ -4,13 +4,10 @@
   "scripts": {
     "start:packages-worker": "CROWD_TEMPORAL_TASKQUEUE=packages-worker CROWD_TEMPORAL_NAMESPACE=$CROWD_PACKAGES_TEMPORAL_NAMESPACE SERVICE=packages-worker tsx src/bin/packages-worker.ts",
     "start:github-repos-enricher": "SERVICE=github-repos-enricher tsx src/bin/github-repos-enricher.ts",
-    "start:osv-sync": "SERVICE=osv-sync tsx src/bin/osv-sync.ts",
     "dev:packages-worker": "CROWD_TEMPORAL_TASKQUEUE=packages-worker CROWD_TEMPORAL_NAMESPACE=$CROWD_PACKAGES_TEMPORAL_NAMESPACE SERVICE=packages-worker LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9233 src/bin/packages-worker.ts",
     "dev:github-repos-enricher": "SERVICE=github-repos-enricher LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9234 src/bin/github-repos-enricher.ts",
-    "dev:osv-sync": "SERVICE=osv-sync LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9235 src/bin/osv-sync.ts",
     "dev:packages-worker:local": "set -a && . ../../../backend/.env.dist.local && . ../../../backend/.env.override.local && set +a && CROWD_TEMPORAL_TASKQUEUE=packages-worker CROWD_TEMPORAL_NAMESPACE=$CROWD_PACKAGES_TEMPORAL_NAMESPACE SERVICE=packages-worker LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9233 src/bin/packages-worker.ts",
     "dev:github-repos-enricher:local": "set -a && . ../../../backend/.env.dist.local && . ../../../backend/.env.override.local && set +a && SERVICE=github-repos-enricher LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9234 src/bin/github-repos-enricher.ts",
-    "dev:osv-sync:local": "set -a && . ../../../backend/.env.dist.local && . ../../../backend/.env.override.local && set +a && SERVICE=osv-sync LOG_LEVEL=trace nodemon --watch src --watch ../../libs --ext ts --exec tsx --inspect=0.0.0.0:9235 src/bin/osv-sync.ts",
     "lint": "npx eslint --ext .ts src --max-warnings=0",
     "format": "npx prettier --write \"src/**/*.ts\"",
     "format-check": "npx prettier --check .",
@@ -24,6 +21,7 @@
     "@crowd/data-access-layer": "workspace:*",
     "@crowd/database": "workspace:*",
     "@crowd/logging": "workspace:*",
+    "@temporalio/activity": "~1.11.8",
     "@temporalio/client": "~1.11.8",
     "@temporalio/workflow": "~1.11.8",
     "semver": "^7.6.0",

pnpm-lock.yaml

@@ -1 +1,2 @@
 export { sayHiNpm } from './npm/activities'
+export { osvSyncEcosystem, osvDeriveCriticalFlag } from './osv/activities'

scripts/services/osv-sync.yaml

@@ -1,8 +1,10 @@
 import { scheduleNpmIngest } from '../npm/schedule'
+import { scheduleOsvSync } from '../osv/schedule'
 import { svc } from '../service'
 
 setImmediate(async () => {
   await svc.init()
   await scheduleNpmIngest()
+  await scheduleOsvSync()
   await svc.start()
 })

services/apps/packages_worker/package.json

@@ -32,20 +32,3 @@ export function getEnricherConfig() {
     idleSleepSec: requireEnvInt('ENRICHER_IDLE_SLEEP_SEC'),
   }
 }
-
-export function getOsvConfig() {
-  const ecosystems = requireEnv('OSV_ECOSYSTEMS')
-    .split(',')
-    .map((e) => e.trim())
-    .filter(Boolean)
-
-  return {
-    bulkBaseUrl: requireEnv('OSV_BULK_BASE_URL'),
-    ecosystems,
-    syncIntervalHours: requireEnvInt('OSV_SYNC_INTERVAL_HOURS'),
-    idleSleepSec: requireEnvInt('OSV_IDLE_SLEEP_SEC'),
-    tmpDir: requireEnv('OSV_TMP_DIR'),
-    batchSize: requireEnvInt('OSV_BATCH_SIZE'),
-    deriveBatchSize: requireEnvInt('OSV_DERIVE_BATCH_SIZE'),
-  }
-}