name: CVE Synchronisation

on:
  schedule:
    - cron: '17 * * * *'
  workflow_dispatch:

permissions:
  contents: write

concurrency:
  group: vuln-cve-update
  cancel-in-progress: false

jobs:
  mirror:
    runs-on: vuln-runner
    timeout-minutes: 240
    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          persist-credentials: true
          fetch-depth: 1
      - name: Sync CVE using persistent local cache
        run: python3 scripts/sync.py --since-year 2017 --cache-dir /var/cache/vuln-cve
      - name: Validate mirror
        run: python3 scripts/validate.py
      - name: Push changes
        run: |
          git config user.name 'Vulnerability Bot'
          git config user.email 'vuln-bot@users.noreply.local'
          git add -A data state
          if git diff --cached --quiet; then
            echo 'No data changes'
            exit 0
          fi
          git commit -m "CVE sync $(date -u +%Y-%m-%dT%H:%M:%SZ)"
          git push origin HEAD:main