Modularize vulnerability importers

scripts/run.sh

@@ -1,33 +1,12 @@
 #!/usr/bin/env bash
+# Run on the existing host-mode Gitea runner.
 set -Eeuo pipefail
 umask 077
-: "${CACHE_ROOT:=/vuln-cache/vuln-builder}"
-: "${GITEA_BASE_URL:=https://git.apex-project.de}"
-: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN missing}"
-mkdir -p "$CACHE_ROOT" "$CACHE_ROOT/sources" "$CACHE_ROOT/releases"
-exec 9>"$CACHE_ROOT/.build.lock"
-/usr/bin/flock -w 1800 9 || { echo 'Another builder run in progress' >&2; exit 1; }
-export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader
-GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
-export GIT_CONFIG_VALUE_0
-# Configurable list; extra feeds tracked in manifest but not yet indexed.
-SOURCES="${VULN_SOURCES:-vuln-cve vuln-nvd vuln-osv vuln-cpe vuln-exploits vuln-microsoft vuln-redhat vuln-oracle vuln-bsi vuln-debian vuln-ubuntu vuln-alpine vuln-suse vuln-suse-vex vuln-almalinux vuln-rocky}"
-for name in $SOURCES; do
-  [[ "$name" =~ ^vuln-[a-z0-9-]+$ ]] || { echo "Invalid source name: $name" >&2; exit 1; }
-  repo="$CACHE_ROOT/sources/$name"
-  url="${GITEA_BASE_URL%/}/VULN/$name.git"
-  if [ ! -d "$repo/.git" ]; then
-    echo "Cloning $name"
-    git clone --quiet --depth 1 --single-branch --branch main "$url" "$repo"
-  else
-    echo "Updating $name"
-    git -C "$repo" fetch --quiet --depth 1 origin main
-    git -C "$repo" reset --hard -q FETCH_HEAD
-    git -C "$repo" clean -fdq
-  fi
-done
-unset GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
-cd "$(dirname "$0")/.."
-python3 scripts/build.py --sources "$CACHE_ROOT/sources" --output "$CACHE_ROOT/releases"
-echo 'Release files:'
-ls -lh "$CACHE_ROOT/releases"/*.zst "$CACHE_ROOT/releases"/manifest.json
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CACHE_ROOT="${CACHE_ROOT:-/opt/gitea-builder/cache/vuln-builder}"
+export CACHE_ROOT
+mkdir -p "$CACHE_ROOT" "$CACHE_ROOT/releases"
+exec 9>"$CACHE_ROOT/.builder.lock"
+flock -w 600 9 || { echo 'Another builder is running' >&2; exit 1; }
+python3 "$ROOT/scripts/sync_sources.py"
+python3 "$ROOT/scripts/build.py" --sources "$CACHE_ROOT/sources" --output "$CACHE_ROOT/releases" "$@"