Keep published counts synchronized

.github/getTrending.py

@@ -481,6 +481,54 @@ def live_pill(path: str, label: str, colour: str, link: str, stamp: str) -> str:
             f"&labelColor=161b22&_={stamp})]({link})")
 
 
+def count_stamp(counts: dict) -> str:
+    keys = ("total_cves", "with_pocs", "kev")
+    if any(not counts.get(key) for key in keys):
+        raise RuntimeError("docs/stats.json does not contain usable corpus counts")
+    return "-".join(str(int(counts[key])) for key in keys)
+
+
+def refresh_count_header() -> int:
+    """Update only the README figures after a corpus-changing sync."""
+    counts = figures()
+    stamp = count_stamp(counts)
+    with open(README, encoding="utf-8") as handle:
+        content = handle.read()
+
+    content, hero_replacements = re.subn(
+        rf"({re.escape(HERO_URL)}\?v=)[^\"]+",
+        rf"\g<1>{stamp}",
+        content,
+        count=1,
+    )
+    badges = {
+        "CVEs with PoCs": pill(
+            "CVEs with PoCs", f"{counts['with_pocs']:,}", "2f81f7",
+            "https://cve.codepwn.win/",
+        ),
+        "known exploited": pill(
+            "known exploited", f"{counts['kev']:,}", "f85149",
+            "https://cve.codepwn.win/",
+        ),
+    }
+    badge_replacements = 0
+    for label, badge in badges.items():
+        content, replaced = re.subn(
+            rf"\[!\[{re.escape(label)}\]\([^)]+\)\]\([^)]+\)",
+            lambda _: badge,
+            content,
+            count=1,
+        )
+        badge_replacements += replaced
+    if hero_replacements != 1 or badge_replacements != len(badges):
+        raise RuntimeError("README count header is missing an expected field")
+
+    with open(README, "w", encoding="utf-8") as handle:
+        handle.write(content)
+    print(f"Updated README counts to {stamp}")
+    return 0
+
+
 def header(stamp: str, synced: str) -> list[str]:
     """Everything above the tables. The banner carries a cache-busting stamp
     because GitHub proxies README images and would otherwise serve a stale copy
@@ -501,10 +549,12 @@ def header(stamp: str, synced: str) -> list[str]:
     return [
         '<div align="center">',
         "",
-        f'<a href="{home}"><img src="{HERO_URL}?v={stamp}" alt="CVE Radar" width="100%"></a>',
+        f'<a href="{home}"><img src="{HERO_URL}?v={count_stamp(counts)}" alt="CVE Radar" width="100%"></a>',
         "",
         "&nbsp;".join(badges),
         "",
+        f'<a href="{home}">cve.codepwn.win</a>',
+        "",
         "</div>",
         "",
     ]
@@ -665,15 +715,8 @@ def main() -> int:
     # No hyphens: they are the field separator in a shields badge path.
     synced = now.strftime("%d %b %Y %H:%M UTC")
     lines = header(stamp, synced)
-    lines.append(f"Exploit repositories with a commit in the last {WINDOW_DAYS} days, "
-                 f"newest first. {KEV_MARK.strip()} marks a CVE CISA lists as "
-                 f"exploited in the wild.")
-    lines.append("")
     if landed:
-        lines.append(f"## Just landed &middot; last {LANDED_DAYS} days")
-        lines.append("")
-        lines.append("No star floor here, so a PoC published this morning shows up "
-                     "the same day rather than once it has been noticed.")
+        lines.append("## Just landed")
         lines.append("")
         lines.append("| Stars | Updated | Repository | Description |")
         lines.append("| --- | --- | --- | --- |")
@@ -727,4 +770,9 @@ def main() -> int:
 
 
 if __name__ == "__main__":
+    if sys.argv[1:] == ["--counts-only"]:
+        raise SystemExit(refresh_count_header())
+    if sys.argv[1:]:
+        print("usage: getTrending.py [--counts-only]", file=sys.stderr)
+        raise SystemExit(2)
     raise SystemExit(main())

.github/workflows/audit_poc_links.yml

@@ -32,6 +32,11 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: python3 scripts/audit_poc_links.py --limit 12000 --references 12000
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
@@ -43,6 +48,10 @@ jobs:
             index/repo_meta.json \
             index/kev.json \
             index/references.txt \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
             cves/
 
           if git diff --cached --quiet; then

.github/workflows/site.yml

@@ -32,6 +32,16 @@ jobs:
       - name: Build site data
         run: python3 scripts/build_site.py
 
+      - name: Verify published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+          git diff --exit-code -- \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json
+
       - name: Configure Pages
         uses: actions/configure-pages@v6
 

.github/workflows/sync_collections.yml

@@ -32,11 +32,23 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
-          git add --all -- index/cve_dates.json index/cve_record_state.json cves/
+          git add --all -- \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
+            index/cve_dates.json \
+            index/cve_record_state.json \
+            cves/
 
           if git diff --cached --quiet; then
             echo "No changes to commit"

.github/workflows/sync_cve_pocs.yml

@@ -34,6 +34,11 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
@@ -46,6 +51,10 @@ jobs:
             index/reference_pocs.txt \
             index/cve_dates.json \
             index/cve_record_state.json \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
             cves/
 
           if git diff --cached --quiet; then

.github/workflows/sync_exploits.yml

@@ -32,11 +32,23 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
-          git add --all -- index/cve_dates.json index/cve_record_state.json cves/
+          git add --all -- \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
+            index/cve_dates.json \
+            index/cve_record_state.json \
+            cves/
           
           if git diff --cached --quiet; then
             echo "No changes to commit"

.github/workflows/sync_metadata.yml

@@ -49,12 +49,21 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
           git add -- \
+            README.md \
             cves/ \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
             index/cve_dates.json \
             index/cve_record_state.json \
             index/github_advisories.json \

.github/workflows/sync_nuclei.yml

@@ -32,11 +32,24 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
-          git add --all -- index/cve_dates.json index/cve_record_state.json index/nuclei.json cves/
+          git add --all -- \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
+            index/cve_dates.json \
+            index/cve_record_state.json \
+            index/nuclei.json \
+            cves/
           if git diff --cached --quiet; then
             echo "No changes to commit"
             exit 0

.github/workflows/sync_pocingithub.yml

@@ -38,11 +38,24 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Refresh published counts
+        run: |
+          python3 .github/hero.py
+          python3 .github/getTrending.py --counts-only
+
       - name: Check for changes and commit
         run: |
           git config user.name 'CVE-BOT'
           git config user.email '[email protected]'
-          git add --all -- index/github.txt index/cve_dates.json index/cve_record_state.json cves/
+          git add --all -- \
+            README.md \
+            docs/hero.svg \
+            docs/social-card.svg \
+            docs/stats.json \
+            index/github.txt \
+            index/cve_dates.json \
+            index/cve_record_state.json \
+            cves/
 
           if git diff --cached --quiet; then
             echo "No changes to commit"