#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
CACHE_ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-ubuntu}"
REPO_URL="${REPO_URL:-https://git.apex-project.de/VULN/vuln-ubuntu.git}"
mkdir -p "$CACHE_ROOT"
exec 9>"$CACHE_ROOT/.sync.lock"
flock -w 300 9 || { echo 'Schon ein anderer Lauf aktiv' >&2; exit 1; }
cd "$CACHE_ROOT"
if [[ ! -d repo/.git ]]; then
  [[ ! -e repo ]] || { echo 'repo existiert ohne gültiges Git-Verzeichnis' >&2; exit 1; }
  git -c "http.extraHeader=$AUTH_HEADER" clone --depth 1 "$REPO_URL" repo
fi
cd repo
# No credentials written to disk. Authentication is supplied on individual
# Git requests through an HTTP header.
AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
git -c "http.extraHeader=$AUTH_HEADER" fetch --depth 1 origin main
git checkout -B main FETCH_HEAD
git reset --hard FETCH_HEAD
# Keep the large upstream checkout outside the Gitea repository.
python3 scripts/sync.py --upstream-cache "$CACHE_ROOT/upstream" --since-year 2017
python3 scripts/validate.py
git add -A data state
if git diff --cached --quiet; then
  echo 'Keine Rohdaten-Änderungen'
  exit 0
fi
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@localhost.invalid' \
  commit -m "Update Ubuntu OSV $(date -u +%Y-%m-%dT%H:%M:%SZ)"
git -c "http.extraHeader=$AUTH_HEADER" push origin HEAD:main