34 lines
1.2 KiB
Bash
34 lines
1.2 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
BASE="${VULN_CACHE_BASE:-/var/lib/act_runner/cache/vuln-redhat}"
|
|
REPO="$BASE/repo"
|
|
URL="${GITEA_REPO_URL:-https://git.apex-project.de/VULN/vuln-redhat.git}"
|
|
mkdir -p "$BASE"
|
|
exec 9>"$BASE/.sync.lock"
|
|
flock -w 120 9 || { echo 'Another run holds the Red Hat lock' >&2; exit 1; }
|
|
: "${GITEA_JOB_TOKEN:?Missing GITEA_JOB_TOKEN secret}"
|
|
AUTH="Authorization: Basic $(printf 'x-access-token:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
git_auth() { git -c "http.extraHeader=$AUTH" "$@"; }
|
|
if [[ ! -d "$REPO/.git" ]]; then
|
|
git_auth clone --branch main --depth 1 "$URL" "$REPO"
|
|
fi
|
|
cd "$REPO"
|
|
git remote set-url origin "$URL"
|
|
if [[ -n "$(git status --porcelain)" ]]; then
|
|
echo 'Dirty cached checkout. Refusing to overwrite local data.' >&2
|
|
exit 1
|
|
fi
|
|
git_auth fetch --depth 1 origin main
|
|
git checkout main
|
|
git merge --ff-only FETCH_HEAD
|
|
python3 scripts/sync.py --since-year 2017 --rotate 250 --prune
|
|
python3 scripts/validate.py
|
|
git add -A data state
|
|
if git diff --cached --quiet; then
|
|
echo 'No changes'
|
|
exit 0
|
|
fi
|
|
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@users.noreply.local' commit -m "Red Hat CSAF update $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
git_auth push origin HEAD:main
|