Initial Builder

2026-11-10 21:56:33 +01:00
commit dd8b159ff5
8 changed files with 267 additions and 0 deletions
@@ -0,0 +1,50 @@
+name: Build vulnerability SQLite
+on:
+  schedule:
+    - cron: '40 */6 * * *'
+  workflow_dispatch:
+permissions:
+  contents: write
+concurrency:
+  group: sqlite-publish
+  cancel-in-progress: false
+jobs:
+  publish:
+    runs-on: [self-hosted, linux, x64, vulnerability]
+    timeout-minutes: 240
+    steps:
+      - name: Checkout builder
+        uses: actions/checkout@v4
+      - name: Checkout CVE raw-data repo
+        uses: actions/checkout@v4
+        with:
+          repository: ${{ github.repository_owner }}/vuln-cve
+          path: sources/vuln-cve
+          token: ${{ secrets.VULN_READ_TOKEN }}
+          persist-credentials: false
+          fetch-depth: 1
+      - name: Verify compression tool
+        run: zstd --version
+      - name: Download latest released baseline, if available
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          mkdir -p prior
+          gh release download --repo "$GITHUB_REPOSITORY" --pattern master.db.zst --dir prior || echo 'No prior release; baseline only'
+          if test -s prior/master.db.zst; then
+            python3 scripts/unpack.py prior/master.db.zst prior/master.db
+          fi
+      - name: Build master and delta
+        run: |
+          REV=$(git -C sources/vuln-cve rev-parse HEAD)
+          if test -f prior/master.db; then
+            python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV" --previous prior/master.db
+          else
+            python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV"
+          fi
+      - name: Publish release
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          TAG="db-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
+          gh release create "$TAG" dist/*.zst dist/manifest.json --title "$TAG" --notes 'Automated vulnerability DB snapshot and incremental delta'