name: Build vulnerability SQLite
on:
  schedule:
    - cron: '40 */6 * * *'
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: sqlite-publish
  cancel-in-progress: false
jobs:
  publish:
    runs-on: [self-hosted, linux, x64, vulnerability]
    timeout-minutes: 240
    steps:
      - name: Checkout builder
        uses: actions/checkout@v4
      - name: Checkout CVE raw-data repo
        uses: actions/checkout@v4
        with:
          repository: ${{ github.repository_owner }}/vuln-cve
          path: sources/vuln-cve
          token: ${{ secrets.VULN_READ_TOKEN }}
          persist-credentials: false
          fetch-depth: 1
      - name: Verify compression tool
        run: zstd --version
      - name: Download latest released baseline, if available
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          mkdir -p prior
          gh release download --repo "$GITHUB_REPOSITORY" --pattern master.db.zst --dir prior || echo 'No prior release; baseline only'
          if test -s prior/master.db.zst; then
            python3 scripts/unpack.py prior/master.db.zst prior/master.db
          fi
      - name: Build master and delta
        run: |
          REV=$(git -C sources/vuln-cve rev-parse HEAD)
          if test -f prior/master.db; then
            python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV" --previous prior/master.db
          else
            python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV"
          fi
      - name: Publish release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          TAG="db-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
          gh release create "$TAG" dist/*.zst dist/manifest.json --title "$TAG" --notes 'Automated vulnerability DB snapshot and incremental delta'