#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN missing}"
ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-suse-vex}"
REPO_URL="${REPO_URL:-https://git.apex-project.de/VULN/vuln-suse-vex.git}"
mkdir -p "$ROOT"
exec 9>"$ROOT/.sync.lock"
flock -w 300 9 || { echo 'Another sync is active' >&2; exit 1; }
cd "$ROOT"
# Credentials only provided to git commands in process environment; never saved to .git/config.
AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
export GIT_TERMINAL_PROMPT=0
GIT_CONFIG_COUNT=1
GIT_CONFIG_KEY_0=http.extraheader
GIT_CONFIG_VALUE_0="$AUTH_HEADER"
export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
if [[ ! -d repo/.git ]]; then
  git clone --depth 1 --branch main "$REPO_URL" repo
fi
cd repo
# Allow only partial data/state from interrupted jobs. Never discard automatically.
DIRTY=$(git status --porcelain)
if [[ -n "$DIRTY" ]]; then
  if git status --porcelain | grep -Ev '^.. (data/|state/)' >/dev/null; then
    echo 'Unexpected dirty paths; manual review required' >&2; exit 1
  fi
  echo 'Previous interrupted import data found; preserving it.'
fi
git fetch --depth 1 origin main
LOCAL=$(git rev-parse HEAD)
REMOTE=$(git rev-parse FETCH_HEAD)
if [[ "$LOCAL" != "$REMOTE" ]]; then
  if [[ -n "$DIRTY" ]]; then
    echo 'Upstream changed while data/state are dirty; manual recovery needed. No reset performed.' >&2
    exit 1
  fi
  git reset --hard FETCH_HEAD
fi
python3 scripts/sync.py --since-year 2017
python3 scripts/validate.py
git config user.name 'Vulnerability Bot'
git config user.email 'vuln-bot@users.noreply.local'
git add -A -- data/ state/
if git diff --cached --quiet; then
  echo 'No data changes'
  exit 0
fi
git commit -m "Sync SUSE VEX $(date -u +%Y-%m-%dT%H:%M:%SZ)"
# Concurrent push can't overwrite others. On failure keep local commit for inspection.
git push origin HEAD:main