Initial Builder

.gitea/workflows/build.yml

@@ -0,0 +1,47 @@
+name: Build SQLite vulnerability index
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "35 3 * * *"
+concurrency:
+  group: vuln-builder
+  cancel-in-progress: false
+jobs:
+  build:
+    runs-on: vuln-builder
+    timeout-minutes: 720
+    env:
+      CACHE_ROOT: /vuln-cache/vuln-builder
+      GITEA_BASE_URL: https://git.apex-project.de
+      GITEA_JOB_TOKEN: ${{ secrets.GITEA_TOKEN }}
+    steps:
+      - name: Install tools
+        shell: sh
+        run: |
+          set -eu
+          if command -v apk >/dev/null 2>&1; then
+            apk add --no-cache bash git python3 sqlite zstd util-linux ca-certificates coreutils
+          elif command -v apt-get >/dev/null 2>&1; then
+            apt-get update
+            apt-get install -y --no-install-recommends bash git python3 sqlite3 zstd util-linux ca-certificates coreutils
+          else
+            echo 'Unsupported job image' >&2
+            exit 1
+          fi
+          /usr/bin/flock --version
+      - name: Bootstrap and build
+        shell: bash
+        run: |
+          set -Eeuo pipefail
+          : "${GITEA_JOB_TOKEN:?missing token}"
+          mkdir -p "$CACHE_ROOT"
+          export GIT_CONFIG_COUNT=1
+          export GIT_CONFIG_KEY_0=http.extraHeader
+          export GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
+          if [ ! -d "$CACHE_ROOT/builder/.git" ]; then
+            git clone --depth 1 --branch main "$GITEA_BASE_URL/VULN/vuln-builder.git" "$CACHE_ROOT/builder"
+          else
+            git -C "$CACHE_ROOT/builder" fetch --depth 1 origin main
+            git -C "$CACHE_ROOT/builder" reset --hard FETCH_HEAD
+          fi
+          bash "$CACHE_ROOT/builder/scripts/run.sh"