Reach the PoCs published before the search window opens

Discovery asks GitHub for repositories pushed in the last three days, so a
proof of concept written for a 2019 CVE in 2021 is unreachable however long
the job runs. nomi-sec/PoC-in-GitHub has collected them daily since 1999.

It collects without filtering, which is how this index inherited its junk
the first time, so nothing arrives trusted: every candidate goes through
qualifying_repo_cves, the same gate a repository found by search must pass.
Of 6,945 candidates the gate rejected 4,110 and accepted 2,835, adding
links to 1,528 entries that had none or had fewer.

Vulhub joins the curated archives beside ExploitDB and Metasploit. It is
241 entries, and each one is a docker-compose file and reproduction steps
rather than a description of a flaw.

Candidates are judged again every week rather than remembered as rejected:
an empty shell in March is often a working exploit by June.

.github/workflows/sync_pocingithub.yml

@@ -0,0 +1,57 @@
+name: Sync PoC-in-GitHub
+
+on:
+  schedule:
+    - cron: '10 5 * * 3'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: repository-updates
+  cancel-in-progress: false
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      # Every candidate is judged again each week rather than remembered as
+      # rejected: a repository that was an empty shell in March is often a
+      # working exploit by June, and re-reading 6,800 of them costs five
+      # minutes.
+      - name: Judge upstream PoC candidates
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 scripts/sync_pocingithub.py
+
+      - name: Check for changes and commit
+        run: |
+          git config user.name 'CVE-BOT'
+          git config user.email '[email protected]'
+          git add --all -- cves/
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git commit -m "Add PoC repositories from upstream collection $(date -u +'%Y-%m-%d')"
+
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            echo "Push rejected; replaying onto the current main (attempt $attempt)"
+            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
+            git rebase FETCH_HEAD
+          done
+          exit 1