feat: add migration for blast radius analysis (CM-1328)

[ulemons]

Summary

Adds the database schema for the blast-radius analysis pipeline (CM-1328). This PR is migrations only — it lays the ground for replicating the blast-radius PoC pipeline (intel → dependents → reachability → report) on top of the new blast-radius worker, backed by the database instead of the PoC's per-run JSON files under data/<VULN-ID>/. API/data-access-layer wiring lands in a follow-up PR.

Changes

• New Flyway migration backend/src/osspckgs/migrations/V1784700000__blast_radius_analyses.sql, adding 5 tables:
  • blast_radius_analyses — one row per submitted job (id matches the analysisId already generated by submitBlastRadiusJob). Stores the raw advisory_osv_id / package_name from the request plus nullable advisory_id / package_id FKs, resolved later — the advisory or package may not be ingested yet when the job is submitted.
  • blast_radius_symbol_specs — stage 1 (intel) output, 1:1 with an analysis.
  • blast_radius_dependents — stage 2 output; unifies the PoC's "analyzed" and "excluded_by_range" dependent lists into one table via an excluded_by_range flag, since excluded candidates never get a resolved version/tarball.
  • blast_radius_verdicts — stage 3 output, 1:1 with a non-excluded dependent, including per-verdict cost_usd/turns_used/model.
  • blast_radius_stage_runs — dedicated performance-monitoring table: one row per (analysis, stage) tracking duration_ms/cost_usd/model, kept independent of the ecosystem-specific tables so it keeps working as more ecosystems are added.
• The aggregated report (naive vs. true blast radius, bucket counts) is intentionally not materialized in its own table — it's derived from blast_radius_verdicts at read time to avoid keeping a denormalized copy in sync.
• Migration is purely additive (CREATE TABLE/INDEX IF NOT EXISTS, no ALTER on existing tables) — no lock risk on packages/advisories in production.
• Verified end-to-end by applying the full migration history against a live packages-db image (built from scripts/packages-db/Dockerfile, which includes pg_partman).

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Performance improvement
• Chore / dependency update
• Documentation

JIRA ticket

CM-1328

[cursor]

PR Summary

Low Risk
Schema-only additive migration with optional FKs to existing tables; no runtime or auth changes in this PR.

Overview
Adds a Flyway migration that persists the blast-radius pipeline (intel → dependents → reachability → report) in Postgres instead of the PoC’s per-run JSON files, so jobs are resumable and queryable.

blast_radius_analyses holds one row per submitted job; id matches the analysisId from submitBlastRadiusJob, with raw advisory_osv_id / package_name and nullable FKs to advisories / packages filled in later. Stage outputs land in blast_radius_symbol_specs, blast_radius_dependents (analyzed + range-excluded dependents via excluded_by_range), and blast_radius_verdicts (reachability per non-excluded dependent, including cost/model metadata). blast_radius_stage_runs tracks per-stage timing and cost independently of ecosystem-specific tables.

Aggregated report metrics are not stored; they’re intended to be computed from blast_radius_verdicts at read time. The change is additive only (CREATE TABLE / indexes, no ALTER on existing tables).

^{Reviewed by Cursor Bugbot for commit b2dd456. Bugbot is set up for automated code reviews on this repo. Configure here.}

[Copilot]

Pull request overview

Adds PostgreSQL persistence for the four-stage blast-radius analysis pipeline.

Changes:

• Adds schemas for analyses, symbol specifications, dependents, verdicts, and stage runs.
• Adds integrity constraints and query indexes.
• Keeps aggregate reports derived from verdict data.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.