39 lines
1.6 KiB
Bash
39 lines
1.6 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${CACHE_ROOT:?CACHE_ROOT fehlt}"
|
|
: "${REPO_URL:?REPO_URL fehlt}"
|
|
cd "$CACHE_ROOT/repo"
|
|
git remote set-url origin "$REPO_URL"
|
|
git fetch origin main
|
|
# Never destroy uncommitted downloaded records. A pending local commit is pushed first.
|
|
LOCAL=$(git rev-parse HEAD)
|
|
REMOTE=$(git rev-parse FETCH_HEAD)
|
|
if [[ "$LOCAL" != "$REMOTE" ]]; then
|
|
if git merge-base --is-ancestor "$REMOTE" "$LOCAL"; then
|
|
if [[ -n "$(git status --porcelain)" ]]; then
|
|
echo 'Local pending commit plus uncommitted files; manual review needed' >&2; exit 1
|
|
fi
|
|
git push origin HEAD:main
|
|
git fetch origin main
|
|
elif [[ -z "$(git status --porcelain)" ]]; then
|
|
# Clean checkout: resetting to the fetched head cannot discard local data.
|
|
git reset --hard FETCH_HEAD
|
|
else
|
|
echo 'Remote changed while cached checkout has local data. Refusing destructive reset.' >&2; exit 1
|
|
fi
|
|
fi
|
|
# Dirty data/state is an interrupted import and is safe to continue. Other changes are not.
|
|
if git status --porcelain | awk '{print substr($0,4)}' | grep -Ev '^(data/|state/)' | grep -q .; then
|
|
echo 'Unexpected changes outside data/ and state/; aborting' >&2; exit 1
|
|
fi
|
|
python3 scripts/sync.py --root . --max-pages "${NVD_MAX_PAGES:-20}"
|
|
python3 scripts/validate.py --changed
|
|
git add -A -- data state
|
|
if git diff --cached --quiet; then
|
|
echo 'No changes'; exit 0
|
|
fi
|
|
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' -c gc.auto=0 commit -qm "Update NVD CPE $(date -u +%FT%TZ)"
|
|
git -c gc.auto=0 push origin HEAD:main
|
|
echo "Updated $(git rev-parse --short HEAD)"
|