52 lines
1.9 KiB
Bash
52 lines
1.9 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN missing}"
|
|
ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-suse-vex}"
|
|
REPO_URL="${REPO_URL:-https://git.apex-project.de/VULN/vuln-suse-vex.git}"
|
|
mkdir -p "$ROOT"
|
|
exec 9>"$ROOT/.sync.lock"
|
|
flock -w 300 9 || { echo 'Another sync is active' >&2; exit 1; }
|
|
cd "$ROOT"
|
|
# Credentials only provided to git commands in process environment; never saved to .git/config.
|
|
AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
|
|
export GIT_TERMINAL_PROMPT=0
|
|
GIT_CONFIG_COUNT=1
|
|
GIT_CONFIG_KEY_0=http.extraheader
|
|
GIT_CONFIG_VALUE_0="$AUTH_HEADER"
|
|
export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
|
|
if [[ ! -d repo/.git ]]; then
|
|
git clone --depth 1 --branch main "$REPO_URL" repo
|
|
fi
|
|
cd repo
|
|
# Allow only partial data/state from interrupted jobs. Never discard automatically.
|
|
DIRTY=$(git status --porcelain)
|
|
if [[ -n "$DIRTY" ]]; then
|
|
if git status --porcelain | grep -Ev '^.. (data/|state/)' >/dev/null; then
|
|
echo 'Unexpected dirty paths; manual review required' >&2; exit 1
|
|
fi
|
|
echo 'Previous interrupted import data found; preserving it.'
|
|
fi
|
|
git fetch --depth 1 origin main
|
|
LOCAL=$(git rev-parse HEAD)
|
|
REMOTE=$(git rev-parse FETCH_HEAD)
|
|
if [[ "$LOCAL" != "$REMOTE" ]]; then
|
|
if [[ -n "$DIRTY" ]]; then
|
|
echo 'Upstream changed while data/state are dirty; manual recovery needed. No reset performed.' >&2
|
|
exit 1
|
|
fi
|
|
git reset --hard FETCH_HEAD
|
|
fi
|
|
python3 scripts/sync.py --since-year 2017
|
|
python3 scripts/validate.py
|
|
git config user.name 'Vulnerability Bot'
|
|
git config user.email 'vuln-bot@users.noreply.local'
|
|
git add -A -- data/ state/
|
|
if git diff --cached --quiet; then
|
|
echo 'No data changes'
|
|
exit 0
|
|
fi
|
|
git commit -m "Sync SUSE VEX $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
# Concurrent push can't overwrite others. On failure keep local commit for inspection.
|
|
git push origin HEAD:main
|