.gitea/workflows/update.yml aktualisiert

.gitea/workflows/update.yml

@@ -1,43 +1,86 @@
-name: NVD Synchronisation
+name: NVD Synchronisation (persistenter Git-Cache)
 
 on:
   schedule:
     - cron: "47 */2 * * *"
   workflow_dispatch:
 
+permissions:
+  contents: write
+
+concurrency:
+  group: vuln-nvd-sync
+  cancel-in-progress: false
+
 jobs:
   mirror:
     runs-on: vuln-runner
     timeout-minutes: 360
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 1
-          persist-credentials: true
-          token: ${{ secrets.GITEA_TOKEN }}
-
-      - name: Tools prüfen
+      - name: NVD Daten im persistenten Checkout aktualisieren
+        shell: bash
+        env:
+          GITEA_JOB_TOKEN: ${{ secrets.GITEA_TOKEN }}
+          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
+          CACHE_ROOT: /var/lib/act_runner/cache/vuln-nvd
         run: |
+          set -Eeuo pipefail
+          umask 077
+          : "${GITEA_JOB_TOKEN:?GITEA_TOKEN fehlt}"
+
+          # Cache persists across Gitea Actions runs on this host.
+          mkdir -p "$CACHE_ROOT"
+          exec 9>"$CACHE_ROOT/.sync.lock"
+          flock -w 300 9 || { echo "Sync wird bereits ausgefuehrt" >&2; exit 1; }
+
+          # Never put the token into Git URLs or stored credentials.
+          ASKPASS="$(mktemp "$CACHE_ROOT/.git-askpass.XXXXXX")"
+          trap 'rm -f "$ASKPASS"' EXIT
+          cat > "$ASKPASS" <<'ASKPASS_SCRIPT'
+          #!/bin/sh
+          case "$1" in
+            *Username*|*username*) printf '%s\n' 'oauth2' ;;
+            *Password*|*password*) printf '%s\n' "$GITEA_JOB_TOKEN" ;;
+            *) exit 1 ;;
+          esac
+          ASKPASS_SCRIPT
+          chmod 700 "$ASKPASS"
+          export GIT_ASKPASS="$ASKPASS" GIT_TERMINAL_PROMPT=0
+
+          REMOTE="https://git.apex-project.de/VULN/vuln-nvd.git"
+          REPO="$CACHE_ROOT/repo"
+
+          if [ ! -d "$REPO/.git" ]; then
+            echo "Erster Git-Checkout (einmaliger voller Download)"
+            # If an interrupted clone left a directory, fail rather than deleting unknown data.
+            if [ -e "$REPO" ]; then
+              echo "Unvollstaendiges Checkout vorhanden: $REPO" >&2
+              exit 1
+            fi
+            git -c credential.helper= clone --branch main --single-branch --depth 1 "$REMOTE" "$REPO"
+          else
+            echo "Persistenter Checkout vorhanden - lade nur neue Git-Objekte"
+            git -C "$REPO" remote set-url origin "$REMOTE"
+            git -C "$REPO" -c credential.helper= fetch --no-tags --depth 1 origin main
+            git -C "$REPO" checkout -B main FETCH_HEAD
+            git -C "$REPO" reset --hard FETCH_HEAD
+            # Only delete untracked files within this dedicated, runner-owned checkout.
+            git -C "$REPO" clean -fd
+          fi
+
+          cd "$REPO"
           python3 --version
           git --version
+          python3 scripts/sync.py --since-year 2017
+          python3 scripts/validate.py --changed-only
 
-      - name: NVD synchronisieren
-        env:
-          NVD_API_KEY: ${{ secrets.NVD_API_KEY }}
-        run: python3 scripts/sync.py --since-year 2017
-
-      - name: Neue oder geänderte Datensätze prüfen
-        run: python3 scripts/validate.py --changed-only
-
-      - name: Änderungen committen und übertragen
-        run: |
           git config user.name "Vulnerability Bot"
           git config user.email "vuln-bot@users.noreply.local"
-          git add -A data/ state/
+          git add -A -- data/ state/
           if git diff --cached --quiet; then
-            echo "Keine Änderungen"
+            echo "Keine Aenderungen, kein Commit"
             exit 0
           fi
           git commit -m "NVD update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
-          git push origin HEAD:main
+          git -c credential.helper= push origin HEAD:main
+          echo "NVD Update abgeschlossen"