From 3041d9b90ebe9e1f58b207b070491d69b165bba8 Mon Sep 17 00:00:00 2001 From: 0xMarcio Date: Thu, 3 Sep 2026 22:21:48 +0200 Subject: [PATCH] Dispatch the site build after every bot commit Commits pushed with the workflow token raise no push event, so site.yml only ran on its 06:20 schedule and the site trailed the index by up to a day. workflow_dispatch is exempt from that rule, so each writer now triggers it after a successful push. The push retry rebased onto the fetched main and, on a conflict, left HEAD there; the next push then succeeded as a no-op and the run went green with its changes discarded. Abort the rebase and fail instead. --- .github/workflows/audit_poc_links.yml | 13 ++++++++++++- .github/workflows/hot_cves.yml | 13 ++++++++++++- .github/workflows/sync_collections.yml | 13 ++++++++++++- .github/workflows/sync_cve_pocs.yml | 13 ++++++++++++- .github/workflows/sync_exploits.yml | 13 ++++++++++++- .github/workflows/sync_metadata.yml | 13 ++++++++++++- .github/workflows/sync_nuclei.yml | 13 ++++++++++++- .github/workflows/sync_pocingithub.yml | 13 ++++++++++++- 8 files changed, 96 insertions(+), 8 deletions(-) diff --git a/.github/workflows/audit_poc_links.yml b/.github/workflows/audit_poc_links.yml index 9e89e108439..94e612a51c5 100644 --- a/.github/workflows/audit_poc_links.yml +++ b/.github/workflows/audit_poc_links.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -38,6 +39,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -63,10 +65,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/hot_cves.yml b/.github/workflows/hot_cves.yml index 4baa24ec039..2faba87203b 100644 --- a/.github/workflows/hot_cves.yml +++ b/.github/workflows/hot_cves.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -45,6 +46,7 @@ jobs: run: python3 .github/getTrending.py - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -69,10 +71,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_collections.yml b/.github/workflows/sync_collections.yml index cd40a1815a6..61e5d0421a9 100644 --- a/.github/workflows/sync_collections.yml +++ b/.github/workflows/sync_collections.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -38,6 +39,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -59,10 +61,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_cve_pocs.yml b/.github/workflows/sync_cve_pocs.yml index b7675033b50..c89a53cd383 100644 --- a/.github/workflows/sync_cve_pocs.yml +++ b/.github/workflows/sync_cve_pocs.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -40,6 +41,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -66,10 +68,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_exploits.yml b/.github/workflows/sync_exploits.yml index 55fa3a990ca..26606476007 100644 --- a/.github/workflows/sync_exploits.yml +++ b/.github/workflows/sync_exploits.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -38,6 +39,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -59,10 +61,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_metadata.yml b/.github/workflows/sync_metadata.yml index 26289848af4..dee4b987b18 100644 --- a/.github/workflows/sync_metadata.yml +++ b/.github/workflows/sync_metadata.yml @@ -14,6 +14,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -55,6 +56,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -80,10 +82,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_nuclei.yml b/.github/workflows/sync_nuclei.yml index 4ecb526d6fb..c0573937e6c 100644 --- a/.github/workflows/sync_nuclei.yml +++ b/.github/workflows/sync_nuclei.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -38,6 +39,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -59,10 +61,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main diff --git a/.github/workflows/sync_pocingithub.yml b/.github/workflows/sync_pocingithub.yml index 58d1626a75a..8d78139c172 100644 --- a/.github/workflows/sync_pocingithub.yml +++ b/.github/workflows/sync_pocingithub.yml @@ -7,6 +7,7 @@ on: permissions: contents: write + actions: write concurrency: group: repository-updates @@ -44,6 +45,7 @@ jobs: python3 .github/getTrending.py --counts-only - name: Check for changes and commit + id: commit run: | git config user.name 'CVE-BOT' git config user.email 'bot@pocindex.io' @@ -66,10 +68,19 @@ jobs: for attempt in 1 2 3; do if git push origin HEAD:main; then + echo "pushed=true" >> "$GITHUB_OUTPUT" exit 0 fi echo "Push rejected; replaying onto the current main (attempt $attempt)" git fetch --unshallow origin main 2>/dev/null || git fetch origin main - git rebase FETCH_HEAD + git rebase FETCH_HEAD || { git rebase --abort; exit 1; } done exit 1 + + # Commits pushed with the workflow token raise no push event, so site.yml + # would otherwise wait for its daily schedule. Dispatching is exempt. + - name: Rebuild and deploy the site + if: steps.commit.outputs.pushed == 'true' + env: + GH_TOKEN: ${{ github.token }} + run: gh workflow run site.yml --ref main