#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
BASE="${VULN_CACHE_BASE:-/var/lib/act_runner/cache/vuln-redhat}"
REPO="$BASE/repo"
URL="${GITEA_REPO_URL:-https://git.apex-project.de/VULN/vuln-redhat.git}"
mkdir -p "$BASE"
exec 9>"$BASE/.sync.lock"
flock -w 120 9 || { echo 'Another run holds the Red Hat lock' >&2; exit 1; }
: "${GITEA_JOB_TOKEN:?Missing GITEA_JOB_TOKEN secret}"
AUTH="Authorization: Basic $(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
git_auth() { git -c "http.extraHeader=$AUTH" "$@"; }
if [[ ! -d "$REPO/.git" ]]; then
  git_auth clone --branch main --depth 1 "$URL" "$REPO"
fi
cd "$REPO"
git remote set-url origin "$URL"
if [[ -n "$(git status --porcelain)" ]]; then
  echo 'Dirty cached checkout. Refusing to overwrite local data.' >&2
  exit 1
fi
git_auth fetch --depth 1 origin main
git checkout main
git merge --ff-only FETCH_HEAD
python3 scripts/sync.py --since-year 2017 --rotate 250 --prune
python3 scripts/validate.py
git add -A data state
if git diff --cached --quiet; then
  echo 'No changes'
  exit 0
fi
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' commit -m "Red Hat CSAF update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
git_auth push origin HEAD:main