Initial Microsoft MSRC mirror

scripts/run-cached.sh

@@ -0,0 +1,43 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+
+BASE="${VULN_CACHE_BASE:-/var/lib/act_runner/cache/vuln-microsoft}"
+REPO="$BASE/repo"
+URL="${GITEA_REPO_URL:-https://git.apex-project.de/VULN/vuln-microsoft.git}"
+mkdir -p "$BASE"
+exec 9>"$BASE/.sync.lock"
+flock -w 60 9 || { echo 'Another sync holds the cache lock' >&2; exit 1; }
+
+if [[ -z "${GITEA_JOB_TOKEN:-}" ]]; then
+  echo 'GITEA_JOB_TOKEN missing; configure secret GITEA_TOKEN or GITEATOKEN' >&2
+  exit 1
+fi
+# No tokens in remotes, logs or files. Token is supplied only as a per-command HTTP header.
+AUTH="Authorization: Basic $(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
+# Gitea job tokens may be accepted with x-access-token username; if unavailable, use a scoped PAT.
+git_auth() { git -c "http.extraHeader=$AUTH" "$@"; }
+
+if [[ ! -d "$REPO/.git" ]]; then
+  git_auth clone --branch main --depth 1 "$URL" "$REPO"
+fi
+cd "$REPO"
+git remote set-url origin "$URL"
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo 'Persistent checkout has uncommitted changes; aborting without resetting data' >&2
+  exit 1
+fi
+git_auth fetch --depth 1 origin main
+git checkout main
+git merge --ff-only FETCH_HEAD
+
+python3 scripts/sync.py --since-year 2017
+python3 scripts/validate.py
+
+git add -A data/ state/
+if git diff --cached --quiet; then
+  echo 'No changes to commit'
+  exit 0
+fi
+git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' commit -m "MSRC update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+git_auth push origin HEAD:main