Audit PoC links against GitHub weekly

Sampling the corpus put 17% of the repositories it links to behind a 404,
so readers were following links to repositories that no longer exist. The
previous audit script was 630 lines, never wired to anything, and kept its
state under a gitignored directory.

Replace it with a check that batches repository lookups through GraphQL
and removes a link only when GitHub answers NOT_FOUND for it, so a
throttle or a network error can never drop one. A quarter of the corpus
runs each week, which stays inside the token's hourly budget and sweeps
everything within the month.

.github/link_audit_state.json

@@ -0,0 +1,3 @@
+{
+  "cursor": "zzzz966/CVE-2020-19360"
+}

.github/workflows/audit_poc_links.yml

@@ -0,0 +1,59 @@
+name: Audit PoC Links
+
+on:
+  schedule:
+    - cron: '40 3 * * 1'
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+concurrency:
+  group: repository-updates
+  cancel-in-progress: false
+
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.13'
+
+      # A quarter of the corpus a week keeps each run inside the token's
+      # hourly budget and sweeps everything within the month.
+      - name: Drop links to deleted repositories
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: python3 scripts/audit_poc_links.py --limit 12000
+
+      - name: Check for changes and commit
+        run: |
+          git config user.name 'CVE-BOT'
+          git config user.email '[email protected]'
+
+          git add --all -- \
+            .github/link_audit_state.json \
+            github.txt \
+            ':(top,glob)[12][0-9][0-9][0-9]/CVE-*.md'
+
+          if git diff --cached --quiet; then
+            echo "No changes to commit"
+            exit 0
+          fi
+
+          git commit -m "Drop PoC links to deleted repositories $(date -u +'%Y-%m-%d')"
+
+          for attempt in 1 2 3; do
+            if git push origin HEAD:main; then
+              exit 0
+            fi
+            echo "Push rejected; replaying onto the current main (attempt $attempt)"
+            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
+            git rebase FETCH_HEAD
+          done
+          exit 1

.github/workflows/site.yml

@@ -8,6 +8,7 @@ on:
     workflows:
       - Sync CVE PoCs
       - Hot CVEs List
+      - Audit PoC Links
     types:
       - completed
   push: