51 lines
1.8 KiB
YAML
51 lines
1.8 KiB
YAML
name: Build vulnerability SQLite
|
|
on:
|
|
schedule:
|
|
- cron: '40 */6 * * *'
|
|
workflow_dispatch:
|
|
permissions:
|
|
contents: write
|
|
concurrency:
|
|
group: sqlite-publish
|
|
cancel-in-progress: false
|
|
jobs:
|
|
publish:
|
|
runs-on: [self-hosted, linux, x64, vulnerability]
|
|
timeout-minutes: 240
|
|
steps:
|
|
- name: Checkout builder
|
|
uses: actions/checkout@v4
|
|
- name: Checkout CVE raw-data repo
|
|
uses: actions/checkout@v4
|
|
with:
|
|
repository: ${{ github.repository_owner }}/vuln-cve
|
|
path: sources/vuln-cve
|
|
token: ${{ secrets.VULN_READ_TOKEN }}
|
|
persist-credentials: false
|
|
fetch-depth: 1
|
|
- name: Verify compression tool
|
|
run: zstd --version
|
|
- name: Download latest released baseline, if available
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
mkdir -p prior
|
|
gh release download --repo "$GITHUB_REPOSITORY" --pattern master.db.zst --dir prior || echo 'No prior release; baseline only'
|
|
if test -s prior/master.db.zst; then
|
|
python3 scripts/unpack.py prior/master.db.zst prior/master.db
|
|
fi
|
|
- name: Build master and delta
|
|
run: |
|
|
REV=$(git -C sources/vuln-cve rev-parse HEAD)
|
|
if test -f prior/master.db; then
|
|
python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV" --previous prior/master.db
|
|
else
|
|
python3 scripts/build.py --source sources/vuln-cve/data --source-revision "$REV"
|
|
fi
|
|
- name: Publish release
|
|
env:
|
|
GH_TOKEN: ${{ github.token }}
|
|
run: |
|
|
TAG="db-${GITHUB_RUN_ID}-${GITHUB_RUN_ATTEMPT}"
|
|
gh release create "$TAG" dist/*.zst dist/manifest.json --title "$TAG" --notes 'Automated vulnerability DB snapshot and incremental delta'
|