extractor/os/rpm: trim AlmaLinux ecosystem suffix to major version

extractor/filesystem/os/ecosystem/ecosystem.go

@@ -84,7 +84,12 @@ func MakeEcosystem(metadata any) osvecosystem.Parsed {
 			return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemOpenEuler, Suffix: m.OpenEulerEcosystemSuffix()}
 		}
 		if m.OSID == "almalinux" {
-			return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemAlmaLinux, Suffix: m.OSVersionID}
+			// OSV.dev keys ALSA advisories by major version only (e.g. "AlmaLinux:9").
+			// VERSION_ID in /etc/os-release is a full point release (e.g. "9.0" or "9.8"),
+			// so trim to the major version only. A bare major such as "9" is returned
+			// unchanged by strings.Cut (found=false, before=full string).
+			majorVersion, _, _ := strings.Cut(m.OSVersionID, ".")
+			return osvecosystem.Parsed{Ecosystem: osvconstants.EcosystemAlmaLinux, Suffix: majorVersion}
 		}
 
 	case *snapmeta.Metadata:

extractor/filesystem/os/ecosystem/ecosystem_test.go

@@ -325,6 +325,24 @@ func TestEcosystemRPM(t *testing.T) {
 			},
 			want: "AlmaLinux:9",
 		},
+		{
+			// Real VERSION_ID from almalinux:9.0 docker image is "9.0" not "9".
+			// OSV.dev ALSA advisories use "AlmaLinux:9" (major only).
+			desc: "AlmaLinux_9_point_release",
+			metadata: &rpmmeta.Metadata{
+				OSID:        "almalinux",
+				OSVersionID: "9.0",
+			},
+			want: "AlmaLinux:9",
+		},
+		{
+			desc: "AlmaLinux_9_point_release_late",
+			metadata: &rpmmeta.Metadata{
+				OSID:        "almalinux",
+				OSVersionID: "9.8",
+			},
+			want: "AlmaLinux:9",
+		},
 		{
 			desc: "AlmaLinux_8",
 			metadata: &rpmmeta.Metadata{
@@ -333,6 +351,14 @@ func TestEcosystemRPM(t *testing.T) {
 			},
 			want: "AlmaLinux:8",
 		},
+		{
+			desc: "AlmaLinux_8_point_release",
+			metadata: &rpmmeta.Metadata{
+				OSID:        "almalinux",
+				OSVersionID: "8.9",
+			},
+			want: "AlmaLinux:8",
+		},
 		{
 			desc: "AlmaLinux_no_version",
 			metadata: &rpmmeta.Metadata{