name: CVE Synchronisation

on:
  workflow_dispatch:
  schedule:
    - cron: "17 * * * *"

permissions:
  contents: write

concurrency:
  group: vuln-cve-update
  cancel-in-progress: false

jobs:
  update:
    runs-on: vuln-runner
    timeout-minutes: 240

    steps:
      - name: Checkout
        uses: actions/checkout@v4
        with:
          persist-credentials: true
          token: ${{ secrets.GITEA_TOKEN }}

      - name: Versionen prüfen
        run: |
          git --version
          python3 --version
          rsync --version

      - name: CVE-Daten aktualisieren
        run: |
          python3 scripts/sync.py --since-year 2017

      - name: Daten validieren
        run: |
          python3 scripts/validate.py

      - name: Änderungen übertragen
        run: |
          git config user.name "Vulnerability Bot"
          git config user.email "vuln-bot@apex-project.de"

          git add data/ state/

          if git diff --cached --quiet; then
            echo "Keine Änderungen"
            exit 0
          fi

          git commit -m "CVE update $(date -u +%F)"
          git push origin HEAD:main