33 lines
1.4 KiB
Bash
33 lines
1.4 KiB
Bash
#!/usr/bin/env bash
|
|
set -Eeuo pipefail
|
|
umask 077
|
|
: "${GITEA_JOB_TOKEN:?GITEA_JOB_TOKEN fehlt}"
|
|
CACHE_ROOT="${CACHE_ROOT:-/var/lib/act_runner/cache/vuln-ubuntu}"
|
|
REPO_URL="${REPO_URL:-https://git.apex-project.de/VULN/vuln-ubuntu.git}"
|
|
mkdir -p "$CACHE_ROOT"
|
|
exec 9>"$CACHE_ROOT/.sync.lock"
|
|
flock -w 300 9 || { echo 'Schon ein anderer Lauf aktiv' >&2; exit 1; }
|
|
cd "$CACHE_ROOT"
|
|
if [[ ! -d repo/.git ]]; then
|
|
[[ ! -e repo ]] || { echo 'repo existiert ohne gültiges Git-Verzeichnis' >&2; exit 1; }
|
|
git -c "http.extraHeader=$AUTH_HEADER" clone --depth 1 "$REPO_URL" repo
|
|
fi
|
|
cd repo
|
|
# No credentials written to disk. Authentication is supplied on individual
|
|
# Git requests through an HTTP header.
|
|
AUTH_HEADER="Authorization: Basic $(printf 'oauth2:%s' "$GITEA_JOB_TOKEN" | base64 -w0)"
|
|
git -c "http.extraHeader=$AUTH_HEADER" fetch --depth 1 origin main
|
|
git checkout -B main FETCH_HEAD
|
|
git reset --hard FETCH_HEAD
|
|
# Keep the large upstream checkout outside the Gitea repository.
|
|
python3 scripts/sync.py --upstream-cache "$CACHE_ROOT/upstream" --since-year 2017
|
|
python3 scripts/validate.py
|
|
git add -A data state
|
|
if git diff --cached --quiet; then
|
|
echo 'Keine Rohdaten-Änderungen'
|
|
exit 0
|
|
fi
|
|
git -c user.name='Vulnerability Bot' -c user.email='vulnerability-bot@localhost.invalid' \
|
|
commit -m "Update Ubuntu OSV $(date -u +%Y-%m-%dT%H:%M:%SZ)"
|
|
git -c "http.extraHeader=$AUTH_HEADER" push origin HEAD:main
|