35 lines
1.4 KiB
Bash
35 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${CACHE_ROOT:=/var/lib/act_runner/cache/vuln-suse}"
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
|
|
: "${REPO_URL:=https://git.apex-project.de/VULN/vuln-suse.git}"
|
|
mkdir -p "$CACHE_ROOT"
|
|
exec 9>"$CACHE_ROOT/.sync.lock"
|
|
flock -w 300 9 || { echo 'Ein anderer SUSE-Lauf ist aktiv' >&2; exit 1; }
|
|
# Temporary, environment-only Git authentication. No token embedded in remote URL or git config file.
|
|
GIT_CONFIG_COUNT=1
|
|
GIT_CONFIG_KEY_0=http.extraheader
|
|
GIT_CONFIG_VALUE_0="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
|
|
export GIT_CONFIG_COUNT GIT_CONFIG_KEY_0 GIT_CONFIG_VALUE_0
|
|
if [[ ! -d "$CACHE_ROOT/repo/.git" ]]; then
|
|
git clone --branch main --single-branch --depth 1 "$REPO_URL" "$CACHE_ROOT/repo"
|
|
fi
|
|
cd "$CACHE_ROOT/repo"
|
|
git remote set-url origin "$REPO_URL"
|
|
git fetch --depth 1 origin main
|
|
git reset --hard FETCH_HEAD
|
|
# Recover tracked files that might have been created during a failed previous run.
|
|
git clean -fd -- scripts/ state/ || true
|
|
python3 scripts/sync.py --since-year 2017
|
|
python3 scripts/validate.py
|
|
git config user.name 'Vulnerability Bot'
|
|
git config user.email 'vulnerability-bot@users.noreply.local'
|
|
git add -A data/ state/
|
|
if git diff --cached --quiet; then
|
|
echo 'Keine Git-Änderungen'
|
|
exit 0
|
|
fi
|
|
git commit -m "Update SUSE CSAF $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
git push origin HEAD:main
|