CI: replace usn git resource with partial-clone task

[selzoc]

Summary

• Replace the (os)-usn-gh-json git resource with a task
  (fetch-usn-gh-json) doing a partial clone (--filter=blob:none --depth 1) + cone sparse-checkout scoped to usn/, cached across
  builds via caches: so warm runs do an incremental fetch +
  reset --hard instead of a full clone.

• Root cause: the stock git resource does a plain git clone
  regardless of sparse_paths/depth config - sparse-checkout only
  trims the working-tree checkout, not what's fetched into
  .git/objects. vex/ (23.8GB) and osv/ (9.8GB) dominate the repo
  at HEAD; usn/, the only directory any of the 3 consuming tasks
  reads, is 570MB.

• Benchmarked cold on a real Concourse worker via fly execute
  (not a pipeline change):

  	time	disk
  old (plain clone)	8909s (~2h28m)	58.5GB
  new, cold	43s	664MB
  new, warm (cache hit)	2s	-

  ~207x faster cold, ~88x smaller, effectively free once cached.

• Dropped the resource's passed: [process-high-critical-cves] pin on
  check-usn-packages-are-available - that job's actual purpose is
  checking USN fix-availability against the live apt repo state, so
  always-fetch-latest is correct behavior, not a regression.

• Added serial: true to check-usn-packages-are-available to prevent
  concurrent builds racing on the same worker-scoped clone cache.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 4423fb2b-2365-4d48-b941-50a97e368fb5

📥 Commits

Reviewing files that changed from the base of the PR and between 05cd708 and 4ebfdf4.

📒 Files selected for processing (3)

• ci/pipeline-template.yml
• ci/tasks/fetch-usn-gh-json.sh
• ci/tasks/fetch-usn-gh-json.yml

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

Walkthrough

The pipeline removes the Git resource for Ubuntu security notices. Three CVE-related jobs now run the fetch-usn-gh-json task. The task uses a cached sparse Git clone, updates it from main, and copies the usn/ directory to the usn-gh-json output. The package availability job now runs serially.

Merge Risk: ⚪ Minimal · up to 4ebfd

This change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: replacing the USN Git resource with a partial-clone task.
Description check	✅ Passed	The description provides a detailed summary of the implementation, root cause, benchmark results, cache behavior, and related pipeline changes. The merge-forward and AI review guidance in the template…
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Description check

Explanation

The description provides a detailed summary of the implementation, root cause, benchmark results, cache behavior, and related pipeline changes. The merge-forward and AI review guidance in the template are process instructions rather than missing change details.

Full details: Docstring Coverage

Explanation

No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1 files. (2 skipped: 2 unsupported.)

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch speedup-usn-github-clone

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[KauzClay]

nice

[selzoc]

First test here: https://bosh.ci.cloudfoundry.org/teams/stemcell/pipelines/ubuntu-jammy/jobs/process-high-critical-cves/builds/562