feat: add consolidated records JSON, independent of any release tag

.github/workflows/regenerate-records-json.yml

@@ -0,0 +1,58 @@
+name: Regenerate consolidated records JSON
+
+# Keeps dist/ave-records-latest.json current automatically, and creates
+# dist/ave-records-v<version>.json the first time a schema version appears
+# (never rewritten after that -- see scripts/build-records.js).
+# Triggers on every push to develop that touches records/ -- the repo that
+# owns the records reacting to its own commits, not a second repo (ave-site)
+# polling for drift. main and develop both require a PR + approving review +
+# signed commits with no bypass for the Actions bot, so this cannot push
+# directly to develop; it opens a PR instead, same as any other change here.
+
+on:
+  push:
+    branches: ["develop"]
+    paths:
+      - "records/**"
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  regenerate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "20"
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Regenerate consolidated records JSON
+        run: node scripts/build-records.js
+
+      - name: Open PR if dist/ changed
+        uses: peter-evans/create-pull-request@v6
+        with:
+          commit-message: "chore: regenerate consolidated records JSON"
+          title: "chore: regenerate consolidated records JSON"
+          body: |
+            Auto-generated by `scripts/build-records.js` after a change to
+            `records/` on `develop`. Regenerates `dist/ave-records-latest.json`
+            (and its manifest) to stay in sync with the current record set.
+            The versioned `dist/ave-records-v<schema_version>.json` snapshot
+            is only touched the first time a given schema version appears --
+            if this diff includes one, that means a new schema version's
+            frozen snapshot was just created, not that an existing one
+            changed.
+          branch: chore/regenerate-dist-records
+          base: develop
+          delete-branch: true
+          add-paths: |
+            dist/

.gitignore

@@ -1,7 +1,6 @@
 __pycache__/
 *.pyc
 .venv/
-dist/
 *.egg-info/
 docs/agents/handoffs/
 .env

README.md

@@ -276,10 +276,16 @@ record = resp.json()  # full record: fingerprint, IOCs, remediation, frameworks
 
 **Pattern 2 — Bundled offline** (air-gapped, regulated environments)
 ```bash
-# Download the full record set at build time and bundle with your scanner
-curl -L https://github.com/aveproject/ave/releases/download/v1.1.0/ave-records-v1.1.0.json \
+# Always current, no release tag required -- regenerated on every records/ change
+curl -L https://raw.githubusercontent.com/aveproject/ave/main/dist/ave-records-latest.json \
+  -o ave-records.json
+
+# Or pin to a frozen, point-in-time snapshot instead of tracking current:
+curl -L https://raw.githubusercontent.com/aveproject/ave/main/dist/ave-records-v1.1.0.json \
   -o ave-records.json
 ```
+A versioned snapshot is also attached to each [GitHub Release](https://github.com/aveproject/ave/releases)
+once one is cut; the raw paths above do not wait on that.
 
 **Pattern 3 — ID-only emission** (SIEM resolves downstream, scanner makes no network calls)
 ```json