196 lines
4.6 KiB
YAML
196 lines
4.6 KiB
YAML
name: Build Vulnerability SQLite
|
|
|
|
on:
|
|
schedule:
|
|
- cron: "47 */6 * * *"
|
|
workflow_dispatch:
|
|
|
|
permissions:
|
|
contents: read
|
|
|
|
concurrency:
|
|
group: vuln-builder
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: vuln-builder
|
|
timeout-minutes: 360
|
|
|
|
env:
|
|
CACHE_ROOT: /vuln-cache/vuln-builder
|
|
SOURCE_READ_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
PYTHONUNBUFFERED: "1"
|
|
|
|
steps:
|
|
- name: Checkout Builder
|
|
uses: actions/checkout@v4
|
|
|
|
- name: Runner-Umgebung diagnostizieren
|
|
shell: bash
|
|
run: |
|
|
echo "=== SYSTEM ==="
|
|
hostname
|
|
whoami
|
|
id
|
|
pwd
|
|
|
|
echo "=== DATEISYSTEM ==="
|
|
ls -ld "$CACHE_ROOT"
|
|
ls -lah "$CACHE_ROOT/releases"
|
|
|
|
echo "=== MOUNT ==="
|
|
findmnt -T "$CACHE_ROOT" || true
|
|
|
|
echo "=== CONTAINER ==="
|
|
if [ -f /.dockerenv ]; then
|
|
echo "Docker-Container erkannt"
|
|
else
|
|
echo "Keine Docker-Markierungsdatei"
|
|
fi
|
|
|
|
echo "=== CGROUP ==="
|
|
cat /proc/1/cgroup
|
|
|
|
echo "=== RUNNER ==="
|
|
env | grep -E '^(RUNNER_NAME|GITEA_RUNNER|CACHE_ROOT)=' || true
|
|
|
|
|
|
|
|
|
|
- name: Abhängigkeiten prüfen
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
echo "=== System ==="
|
|
hostname
|
|
whoami
|
|
pwd
|
|
|
|
echo "=== Programme ==="
|
|
python3 --version
|
|
git --version
|
|
|
|
if ! command -v zstd >/dev/null 2>&1; then
|
|
echo "zstd fehlt - Installation erforderlich"
|
|
|
|
if command -v apt-get >/dev/null 2>&1; then
|
|
if [ "$(id -u)" -eq 0 ]; then
|
|
apt-get update
|
|
apt-get install -y zstd
|
|
elif command -v sudo >/dev/null 2>&1; then
|
|
sudo apt-get update
|
|
sudo apt-get install -y zstd
|
|
else
|
|
echo "FEHLER: zstd fehlt und keine Installationsrechte"
|
|
exit 1
|
|
fi
|
|
else
|
|
echo "FEHLER: zstd manuell installieren"
|
|
exit 1
|
|
fi
|
|
fi
|
|
|
|
zstd --version
|
|
|
|
- name: Persistenten Cache vorbereiten
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
mkdir -p "$CACHE_ROOT/sources"
|
|
mkdir -p "$CACHE_ROOT/releases"
|
|
|
|
echo "=== Cache-Verzeichnis ==="
|
|
echo "$CACHE_ROOT"
|
|
|
|
echo "=== Vorhandene Git-Repositories ==="
|
|
|
|
count=0
|
|
|
|
for repo in "$CACHE_ROOT"/sources/*; do
|
|
[ -d "$repo" ] || continue
|
|
|
|
if git -C "$repo" rev-parse --is-inside-work-tree \
|
|
>/dev/null 2>&1; then
|
|
echo "CACHE: $(basename "$repo")"
|
|
count=$((count + 1))
|
|
fi
|
|
done
|
|
|
|
echo "Repositories im Cache: $count"
|
|
|
|
echo "=== Speicherplatz ==="
|
|
df -h "$CACHE_ROOT"
|
|
du -sh "$CACHE_ROOT"/sources 2>/dev/null || true
|
|
du -sh "$CACHE_ROOT"/releases 2>/dev/null || true
|
|
|
|
- name: Synchronize sources and build SQLite
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
echo "========================================"
|
|
echo "Vulnerability SQLite Builder"
|
|
echo "========================================"
|
|
|
|
bash scripts/run.sh
|
|
|
|
- name: Release-Dateien prüfen
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
RELEASE="$CACHE_ROOT/releases"
|
|
|
|
echo "=== Release-Dateien ==="
|
|
ls -lh "$RELEASE"
|
|
|
|
test -s "$RELEASE/master.db"
|
|
test -s "$RELEASE/master.db.zst"
|
|
test -s "$RELEASE/manifest.json"
|
|
|
|
echo "=== SQLite Integrität ==="
|
|
|
|
python3 - <<'PY'
|
|
import os
|
|
import sqlite3
|
|
|
|
db = os.path.join(
|
|
os.environ["CACHE_ROOT"],
|
|
"releases",
|
|
"master.db"
|
|
)
|
|
|
|
con = sqlite3.connect(
|
|
f"file:{db}?mode=ro",
|
|
uri=True
|
|
)
|
|
|
|
result = con.execute(
|
|
"PRAGMA integrity_check"
|
|
).fetchone()[0]
|
|
|
|
print("SQLite:", result)
|
|
|
|
if result != "ok":
|
|
raise RuntimeError("SQLite database damaged")
|
|
|
|
print("\nDatenquellen:")
|
|
for row in con.execute("""
|
|
SELECT name, indexed, documents
|
|
FROM sources
|
|
ORDER BY name
|
|
"""):
|
|
print(*row, sep=" | ")
|
|
|
|
con.close()
|
|
PY
|
|
|
|
echo "=== Zstandard Integrität ==="
|
|
zstd -t "$RELEASE/master.db.zst"
|
|
|
|
echo "=== Fertig ==="
|
|
|