name: NVD CPE and Match Criteria Mirror

on:
  workflow_dispatch:
  schedule:
    - cron: "19 */4 * * *"

permissions:
  contents: write

concurrency:
  group: vuln-cpe-update
  cancel-in-progress: false

jobs:
  update:
    name: Update NVD CPE
    runs-on: vulnerability
    timeout-minutes: 240

    env:
      CACHE_ROOT: /vuln-cache/vuln-cpe
      REPO_URL: https://git.apex-project.de/VULN/vuln-cpe.git

      GITEA_JOB_TOKEN: ${{ secrets.GITEA_TOKEN }}
      NVD_API_KEY: ${{ secrets.NVD_API_KEY }}

      NVD_MAX_PAGES: "20"

    steps:
      - name: Install dependencies
        shell: bash
        run: |
            set -Eeuo pipefail

            if command -v apk >/dev/null 2>&1; then
              apk add --no-cache \
                bash \
                git \
                python3 \
                util-linux \
                ca-certificates \
                coreutils

            elif command -v apt-get >/dev/null 2>&1; then
              apt-get update
              apt-get install -y --no-install-recommends \
                git \
                python3 \
                util-linux \
                ca-certificates \
                coreutils
            fi
                echo "flock:"
                command -v flock
                flock --version

      - name: Verify persistent cache
        shell: bash
        run: |
          set -Eeuo pipefail

          mkdir -p "$CACHE_ROOT"

          test -w "$CACHE_ROOT" || {
            echo "ERROR: Cache not writable"
            exit 1
          }

          echo "Cache: $CACHE_ROOT"
          df -h "$CACHE_ROOT"

      - name: Sync NVD CPE
        shell: bash
        run: |
          set -Eeuo pipefail
          umask 077

          : "${GITEA_JOB_TOKEN:?GITEA_TOKEN fehlt}"

          mkdir -p "$CACHE_ROOT"

          # Prevent concurrent jobs using this cache
          exec 9>"$CACHE_ROOT/.sync.lock"

          flock -w 300 9 || {
            echo "Another CPE update is running"
            exit 1
          }

          # Authenticate Git without storing the token
          export GIT_CONFIG_COUNT=1
          export GIT_CONFIG_KEY_0=http.extraHeader
          export GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"

          # Bootstrap persistent checkout
          if [ ! -d "$CACHE_ROOT/repo/.git" ]; then
            echo "Creating persistent Git checkout"

            git clone \
              --depth 1 \
              --branch main \
              "$REPO_URL" \
              "$CACHE_ROOT/repo"
          fi

          # Existing sync script handles:
          # - Git fetch
          # - NVD CPE API
          # - NVD CPE Match API
          # - Validation
          # - Git commit and push

          bash "$CACHE_ROOT/repo/scripts/run-cached.sh"

      - name: Show cache usage
        if: always()
        shell: bash
        run: |
          echo "Persistent cache usage:"

          if [ -d "$CACHE_ROOT" ]; then
            du -sh "$CACHE_ROOT"
          fi

          echo "Finished"