name: Sync CVE List V5
on:
  schedule:
    - cron: '17 * * * *'
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: cve-mirror
  cancel-in-progress: false
jobs:
  mirror:
    runs-on: [self-hosted, linux, x64, vulnerability]
    timeout-minutes: 240
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: true
          fetch-depth: 1
      - name: Verify tools
        run: |
          git --version
          rsync --version | head -1
          python3 --version
      - name: Download, verify, and mirror
        run: python3 scripts/sync.py --since-year 2017
      - name: Validate mirror
        run: python3 scripts/validate.py
      - name: Commit and push changed records
        run: |
          git config user.name 'vulnerability-bot'
          git config user.email 'vulnerability-bot@users.noreply.github.com'
          git add -A data state
          if git diff --cached --quiet; then
            echo 'No changes'
            exit 0
          fi
          git commit -m "Sync CVE records ($(date -u +%Y-%m-%dT%H:%M:%SZ))"
          git push origin HEAD:main