M1.11: Wire up `forkguard init` and `forkguard ingest`

[bjcorder]

Labels: type:feature, area:cli, area:ingest, priority:critical,
status:blocked, milestone:M1, phase:2

Summary

Wire the cobra subcommands init and ingest to the store and ingest
packages, producing a working end-to-end ingestion flow.

Acceptance criteria

• forkguard init creates ~/.forkguard/state.db, runs migrations,
  optionally loads --forks <path> (loading is implemented in M2.x but
  the flag is accepted now and validated)
• forkguard ingest --upstream <name> performs the full flow:
  1. Open the store
  2. Look up or create the Upstream record
  3. Call OSVClient.QueryByRepo
  4. Normalize each result
  5. Upsert advisories (dedupe by source + source_id)
  6. Upsert fix commits (dedupe per design)
  7. Update upstreams.last_ingested_at
• Re-running ingest is idempotent — no duplicate advisories or fix
  commits
• Structured logging emits a summary at the end: N advisories
  processed, M new, K fix commits, etc.

Dependencies

Depends on: #8, #10

Verification

./forkguard init
./forkguard ingest --upstream github.com/openssl/openssl
sqlite3 ~/.forkguard/state.db 'SELECT COUNT(*) FROM advisories;'
# > 0
sqlite3 ~/.forkguard/state.db 'SELECT COUNT(*) FROM fix_commits;'
# > 0

# Idempotency:
./forkguard ingest --upstream github.com/openssl/openssl
sqlite3 ~/.forkguard/state.db 'SELECT COUNT(*) FROM advisories;'
# Same as before

This completes Milestone M1.

---

Milestone M2: Repository Mirroring & Ancestry

---

[bjcorder]

Implemented in ed39d2cdba42.

Summary:

• Wired forkguard init to create/open the configured SQLite DB, run migrations, and accept/validate a --forks path for M2 loading.
• Wired forkguard ingest --upstream <name> through store initialization, upstream get/create, OSV query, normalization, advisory/fix-commit upserts, upstream linking, and last_ingested_at updates.
• Added an ingest service with idempotency coverage and structured summary logging.
• Added compatibility fallback for current OSV GIT package queries while preserving the issue-required repo query attempt.

Validation:

• go test ./internal/ingest/... — passed
• go test ./... — passed
• go vet ./... — passed
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run ./... — passed
• FORKGUARD_DB_PATH=<temp>/state.db ./forkguard init --forks <temp>/forks.yaml — passed
• FORKGUARD_DB_PATH=<temp>/state.db ./forkguard ingest --upstream github.com/openssl/openssl — passed
• sqlite3 <temp>/state.db 'SELECT COUNT(*) FROM advisories; SELECT COUNT(*) FROM fix_commits;' — passed, returned 107 advisories and 259 fix commits
• Re-running ingest and comparing counts — passed, counts remained 107,259

Notes / follow-ups:

• None

[bjcorder]

Follow-up implemented in a5dbbf6b5069.

Summary:

• Wrapped M1 OSV persistence in a database transaction so mid-run failures cannot leave partially committed advisory/fix rows with stale ingest state.

Validation:

• go test ./internal/ingest/... — passed
• go test ./... — passed
• go vet ./... — passed
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run ./... — passed

Notes / follow-ups:

• None

[bjcorder]

Implemented in PR #39: #39

Implementation commits:

• ed39d2cdba42 — Wire up forkguard init and ingest
• a5dbbf6b5069 — Make OSV ingest transactional

Validation:

• make generate — passed
• go build ./... — passed
• go vet ./... — passed
• go run github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8 run ./... — passed
• go test ./... -race -coverprofile=coverage.out — passed
• ./forkguard init and ./forkguard ingest --upstream github.com/openssl/openssl with idempotency check — passed

Closure status:

• This issue is ready to close when the PR is merged.

Remaining notes:

• None