41 lines
1.7 KiB
Bash
41 lines
1.7 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${CACHE_ROOT:?CACHE_ROOT fehlt}"
|
|
: "${REPO_URL:?REPO_URL fehlt}"
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
|
|
mkdir -p "$CACHE_ROOT"
|
|
exec 9>"$CACHE_ROOT/.sync.lock"
|
|
if command -v /usr/bin/flock >/dev/null 2>&1; then LOCK=/usr/bin/flock; else LOCK=$(command -v flock); fi
|
|
"$LOCK" -n 9 || { echo 'Ein anderer Sync verwendet diesen Repository-Cache.' >&2; exit 1; }
|
|
AUTH="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 | tr -d '\n')"
|
|
export GIT_CONFIG_COUNT=1 GIT_CONFIG_KEY_0=http.extraHeader GIT_CONFIG_VALUE_0="$AUTH"
|
|
if [ ! -d "$CACHE_ROOT/repo/.git" ]; then
|
|
if [ -e "$CACHE_ROOT/repo" ]; then echo 'Repo-Verzeichnis existiert ohne .git' >&2; exit 1; fi
|
|
git clone --depth 1 --branch main "$REPO_URL" "$CACHE_ROOT/repo"
|
|
fi
|
|
cd "$CACHE_ROOT/repo"
|
|
git remote set-url origin "$REPO_URL"
|
|
git fetch origin main
|
|
# Dirty data may be left behind by interrupted imports. Never silently reset it.
|
|
if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then
|
|
if [ -n "$(git status --porcelain)" ]; then
|
|
echo 'Remote wurde geändert und der Cache enthält ungespeicherte Dateien; kein Reset.' >&2
|
|
exit 1
|
|
fi
|
|
git merge --ff-only origin/main || { echo 'Lokale Commits weichen vom Remote ab; manuelle Prüfung erforderlich.' >&2; exit 1; }
|
|
fi
|
|
python3 scripts/sync.py
|
|
python3 scripts/validate.py
|
|
git config user.name 'Vulnerability Bot'
|
|
git config user.email 'vulnerability-bot@users.noreply.local'
|
|
git add -A data state
|
|
if git diff --cached --quiet; then
|
|
echo 'Keine Datenänderungen'
|
|
else
|
|
git -c gc.auto=0 commit -q -m "Update ${REPO_NAME:-vulnerability} $(date -u +%FT%TZ)"
|
|
fi
|
|
if [ "$(git rev-parse HEAD)" != "$(git rev-parse origin/main)" ]; then
|
|
git -c gc.auto=0 push origin HEAD:main
|
|
fi
|