Initial Red Hat CSAF mirror

scripts/run-cached.sh

@@ -0,0 +1,33 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+umask 077
+BASE="${VULN_CACHE_BASE:-/var/lib/act_runner/cache/vuln-redhat}"
+REPO="$BASE/repo"
+URL="${GITEA_REPO_URL:-https://git.apex-project.de/VULN/vuln-redhat.git}"
+mkdir -p "$BASE"
+exec 9>"$BASE/.sync.lock"
+flock -w 120 9 || { echo 'Another run holds the Red Hat lock' >&2; exit 1; }
+: "${GITEA_JOB_TOKEN:?Missing GITEA_JOB_TOKEN secret}"
+AUTH="Authorization: Basic $(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
+git_auth() { git -c "http.extraHeader=$AUTH" "$@"; }
+if [[ ! -d "$REPO/.git" ]]; then
+  git_auth clone --branch main --depth 1 "$URL" "$REPO"
+fi
+cd "$REPO"
+git remote set-url origin "$URL"
+if [[ -n "$(git status --porcelain)" ]]; then
+  echo 'Dirty cached checkout. Refusing to overwrite local data.' >&2
+  exit 1
+fi
+git_auth fetch --depth 1 origin main
+git checkout main
+git merge --ff-only FETCH_HEAD
+python3 scripts/sync.py --since-year 2017 --rotate 250 --prune
+python3 scripts/validate.py
+git add -A data state
+if git diff --cached --quiet; then
+  echo 'No changes'
+  exit 0
+fi
+git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' commit -m "Red Hat CSAF update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
+git_auth push origin HEAD:main