44 lines
1.5 KiB
Bash
44 lines
1.5 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
|
|
BASE="${VULN_CACHE_BASE:-/var/lib/act_runner/cache/vuln-microsoft}"
|
|
REPO="$BASE/repo"
|
|
URL="${GITEA_REPO_URL:-https://git.apex-project.de/VULN/vuln-microsoft.git}"
|
|
mkdir -p "$BASE"
|
|
exec 9>"$BASE/.sync.lock"
|
|
flock -w 60 9 || { echo 'Another sync holds the cache lock' >&2; exit 1; }
|
|
|
|
if [[ -z "${GITEA_JOB_TOKEN:-}" ]]; then
|
|
echo 'GITEA_JOB_TOKEN missing; configure secret GITEA_TOKEN or GITEATOKEN' >&2
|
|
exit 1
|
|
fi
|
|
# No tokens in remotes, logs or files. Token is supplied only as a per-command HTTP header.
|
|
AUTH="Authorization: Basic $(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
# Gitea job tokens may be accepted with x-access-token username; if unavailable, use a scoped PAT.
|
|
git_auth() { git -c "http.extraHeader=$AUTH" "$@"; }
|
|
|
|
if [[ ! -d "$REPO/.git" ]]; then
|
|
git_auth clone --branch main --depth 1 "$URL" "$REPO"
|
|
fi
|
|
cd "$REPO"
|
|
git remote set-url origin "$URL"
|
|
if [[ -n "$(git status --porcelain)" ]]; then
|
|
echo 'Persistent checkout has uncommitted changes; aborting without resetting data' >&2
|
|
exit 1
|
|
fi
|
|
git_auth fetch --depth 1 origin main
|
|
git checkout main
|
|
git merge --ff-only FETCH_HEAD
|
|
|
|
python3 scripts/sync.py --since-year 2017
|
|
python3 scripts/validate.py
|
|
|
|
git add -A data/ state/
|
|
if git diff --cached --quiet; then
|
|
echo 'No changes to commit'
|
|
exit 0
|
|
fi
|
|
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' commit -m "MSRC update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
git_auth push origin HEAD:main
|