.gitea/workflows/build.yml aktualisiert

.gitea/workflows/build.yml

@@ -1,23 +1,164 @@
-# TEMPLATE: rename to build.yml ONLY if no other builder workflow is active.
-# Prefer updating the existing workflow to invoke `bash scripts/run.sh`.
+
 name: Build Vulnerability SQLite
+
 on:
   schedule:
-    - cron: '47 */6 * * *'
+    - cron: "47 */6 * * *"
   workflow_dispatch:
+
 permissions:
   contents: read
+
 concurrency:
   group: vuln-builder
   cancel-in-progress: false
+
 jobs:
   build:
     runs-on: vuln-builder
     timeout-minutes: 360
+
+    env:
+      CACHE_ROOT: /opt/gitea-builder/cache/vuln-builder
+      SOURCE_READ_TOKEN: ${{ secrets.GITEA_TOKEN }}
+      PYTHONUNBUFFERED: "1"
+
     steps:
-      - uses: actions/checkout@v4
+      - name: Checkout Builder
+        uses: actions/checkout@v4
+
+      - name: Abhängigkeiten prüfen
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          echo "=== System ==="
+          hostname
+          whoami
+          pwd
+
+          echo "=== Programme ==="
+          python3 --version
+          git --version
+
+          if ! command -v zstd >/dev/null 2>&1; then
+            echo "zstd fehlt - Installation erforderlich"
+
+            if command -v apt-get >/dev/null 2>&1; then
+              if [ "$(id -u)" -eq 0 ]; then
+                apt-get update
+                apt-get install -y zstd
+              elif command -v sudo >/dev/null 2>&1; then
+                sudo apt-get update
+                sudo apt-get install -y zstd
+              else
+                echo "FEHLER: zstd fehlt und keine Installationsrechte"
+                exit 1
+              fi
+            else
+              echo "FEHLER: zstd manuell installieren"
+              exit 1
+            fi
+          fi
+
+          zstd --version
+
+      - name: Persistenten Cache vorbereiten
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          mkdir -p "$CACHE_ROOT/sources"
+          mkdir -p "$CACHE_ROOT/releases"
+
+          echo "=== Cache-Verzeichnis ==="
+          echo "$CACHE_ROOT"
+
+          echo "=== Vorhandene Git-Repositories ==="
+
+          count=0
+
+          for repo in "$CACHE_ROOT"/sources/*; do
+            [ -d "$repo" ] || continue
+
+            if git -C "$repo" rev-parse --is-inside-work-tree \
+                >/dev/null 2>&1; then
+              echo "CACHE: $(basename "$repo")"
+              count=$((count + 1))
+            fi
+          done
+
+          echo "Repositories im Cache: $count"
+
+          echo "=== Speicherplatz ==="
+          df -h "$CACHE_ROOT"
+          du -sh "$CACHE_ROOT"/sources 2>/dev/null || true
+          du -sh "$CACHE_ROOT"/releases 2>/dev/null || true
+
       - name: Synchronize sources and build SQLite
-        env:
-          CACHE_ROOT: /opt/gitea-builder/cache/vuln-builder
-          SOURCE_READ_TOKEN: ${{ secrets.GITEA_TOKEN }}
-        run: bash scripts/run.sh
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          echo "========================================"
+          echo "Vulnerability SQLite Builder"
+          echo "========================================"
+
+          bash scripts/run.sh
+
+      - name: Release-Dateien prüfen
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+
+          RELEASE="$CACHE_ROOT/releases"
+
+          echo "=== Release-Dateien ==="
+          ls -lh "$RELEASE"
+
+          test -s "$RELEASE/master.db"
+          test -s "$RELEASE/master.db.zst"
+          test -s "$RELEASE/manifest.json"
+
+          echo "=== SQLite Integrität ==="
+
+          python3 - <<'PY'
+          import os
+          import sqlite3
+
+          db = os.path.join(
+              os.environ["CACHE_ROOT"],
+              "releases",
+              "master.db"
+          )
+
+          con = sqlite3.connect(
+              f"file:{db}?mode=ro",
+              uri=True
+          )
+
+          result = con.execute(
+              "PRAGMA integrity_check"
+          ).fetchone()[0]
+
+          print("SQLite:", result)
+
+          if result != "ok":
+              raise RuntimeError("SQLite database damaged")
+
+          print("\nDatenquellen:")
+          for row in con.execute("""
+              SELECT name, indexed, documents
+              FROM sources
+              ORDER BY name
+          """):
+              print(*row, sep=" | ")
+
+          con.close()
+          PY
+
+          echo "=== Zstandard Integrität ==="
+          zstd -t "$RELEASE/master.db.zst"
+
+          echo "=== Fertig ==="
+