128 lines
3.0 KiB
YAML
128 lines
3.0 KiB
YAML
name: NVD CPE and Match Criteria Mirror
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
schedule:
|
|
- cron: "19 */4 * * *"
|
|
|
|
permissions:
|
|
contents: write
|
|
|
|
concurrency:
|
|
group: vuln-cpe-update
|
|
cancel-in-progress: false
|
|
|
|
jobs:
|
|
update:
|
|
name: Update NVD CPE
|
|
runs-on: vulnerability
|
|
timeout-minutes: 240
|
|
|
|
env:
|
|
CACHE_ROOT: /vuln-cache/vuln-cpe
|
|
REPO_URL: https://git.apex-project.de/VULN/vuln-cpe.git
|
|
|
|
GITEA_JOB_TOKEN: ${{ secrets.GITEA_TOKEN }}
|
|
NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
|
|
|
|
NVD_MAX_PAGES: "20"
|
|
|
|
steps:
|
|
- name: Install dependencies
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
if command -v apk >/dev/null 2>&1; then
|
|
apk add --no-cache \
|
|
bash \
|
|
git \
|
|
python3 \
|
|
util-linux \
|
|
ca-certificates \
|
|
coreutils
|
|
|
|
elif command -v apt-get >/dev/null 2>&1; then
|
|
apt-get update
|
|
apt-get install -y --no-install-recommends \
|
|
git \
|
|
python3 \
|
|
util-linux \
|
|
ca-certificates \
|
|
coreutils
|
|
fi
|
|
echo "flock:"
|
|
command -v flock
|
|
flock --version
|
|
|
|
- name: Verify persistent cache
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
|
|
mkdir -p "$CACHE_ROOT"
|
|
|
|
test -w "$CACHE_ROOT" || {
|
|
echo "ERROR: Cache not writable"
|
|
exit 1
|
|
}
|
|
|
|
echo "Cache: $CACHE_ROOT"
|
|
df -h "$CACHE_ROOT"
|
|
|
|
- name: Sync NVD CPE
|
|
shell: bash
|
|
run: |
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
|
|
: "${GITEA_JOB_TOKEN:?GITEA_TOKEN fehlt}"
|
|
|
|
mkdir -p "$CACHE_ROOT"
|
|
|
|
# Prevent concurrent jobs using this cache
|
|
exec 9>"$CACHE_ROOT/.sync.lock"
|
|
|
|
flock -w 300 9 || {
|
|
echo "Another CPE update is running"
|
|
exit 1
|
|
}
|
|
|
|
# Authenticate Git without storing the token
|
|
export GIT_CONFIG_COUNT=1
|
|
export GIT_CONFIG_KEY_0=http.extraHeader
|
|
export GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
|
|
# Bootstrap persistent checkout
|
|
if [ ! -d "$CACHE_ROOT/repo/.git" ]; then
|
|
echo "Creating persistent Git checkout"
|
|
|
|
git clone \
|
|
--depth 1 \
|
|
--branch main \
|
|
"$REPO_URL" \
|
|
"$CACHE_ROOT/repo"
|
|
fi
|
|
|
|
# Existing sync script handles:
|
|
# - Git fetch
|
|
# - NVD CPE API
|
|
# - NVD CPE Match API
|
|
# - Validation
|
|
# - Git commit and push
|
|
|
|
bash "$CACHE_ROOT/repo/scripts/run-cached.sh"
|
|
|
|
- name: Show cache usage
|
|
if: always()
|
|
shell: bash
|
|
run: |
|
|
echo "Persistent cache usage:"
|
|
|
|
if [ -d "$CACHE_ROOT" ]; then
|
|
du -sh "$CACHE_ROOT"
|
|
fi
|
|
|
|
echo "Finished"
|
|
|