37 lines
1.4 KiB
Bash
37 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
|
|
CACHE_ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-alpine}"
|
|
REMOTE="${REPO_URL:-https://git.apex-project.de/VULN/vuln-alpine.git}"
|
|
mkdir -p "$CACHE_ROOT"
|
|
exec 9>"$CACHE_ROOT/.sync.lock"
|
|
flock -w 3600 9 || { echo 'Another Alpine mirror job still running' >&2; exit 1; }
|
|
# Authentication only in the environment of git subprocesses, never in remote URLs or .git/config.
|
|
AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
export GIT_CONFIG_COUNT=1
|
|
export GIT_CONFIG_KEY_0=http.extraheader
|
|
export GIT_CONFIG_VALUE_0="$AUTH_HEADER"
|
|
export GIT_TERMINAL_PROMPT=0
|
|
REPO="$CACHE_ROOT/repo"
|
|
if [[ ! -d "$REPO/.git" ]]; then
|
|
git clone --depth 1 --branch main "$REMOTE" "$REPO"
|
|
else
|
|
git -C "$REPO" remote set-url origin "$REMOTE"
|
|
git -C "$REPO" fetch --depth 1 origin main
|
|
git -C "$REPO" reset --hard FETCH_HEAD
|
|
fi
|
|
cd "$REPO"
|
|
python3 scripts/sync.py --repo "$REPO" --http-cache "$CACHE_ROOT/http-cache.json" --min-release 5
|
|
python3 scripts/validate.py
|
|
git config user.name 'Vulnerability Bot'
|
|
git config user.email 'vuln-bot@users.noreply.local'
|
|
git add -A data/secdb state/manifest.json
|
|
if git diff --cached --quiet; then
|
|
echo 'No Alpine changes; nothing to push'
|
|
exit 0
|
|
fi
|
|
git commit -m "Update Alpine secdb $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
# If another actor changed main during this run, do not force-push.
|
|
git push origin HEAD:main
|