Track PoC releases independently and expand verified sources

.github/workflows/audit_poc_links.yml

@@ -40,6 +40,9 @@ jobs:
       - name: Verify the generated index
         run: python3 scripts/build_site.py
 
+      - name: Record published artifact releases
+        run: python3 scripts/releases.py --record
+
       - name: Refresh published counts
         run: |
           python3 .github/hero.py
@@ -62,6 +65,7 @@ jobs:
             docs/social-card.svg \
             docs/stats.json \
             docs/kev.svg \
+            index/releases/ \
             cves/
 
           if git diff --cached --quiet; then

.github/workflows/hot_cves.yml

@@ -51,6 +51,9 @@ jobs:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         run: python3 scripts/sync_pocingithub.py --input index/trending.json
 
+      - name: Record published artifact releases
+        run: python3 scripts/releases.py --record
+
       - name: Redraw the banner and recount the index
         run: |
           # Counts the corpus with the site build's own parser, so the banner can
@@ -74,10 +77,14 @@ jobs:
             index/reference_pocs.txt \
             index/cve_dates.json \
             index/cve_record_state.json \
+            index/github_discovery_state.json \
+            index/source_artifact_reviews.json \
+            index/source_artifact_candidates.json \
             docs/hero.svg \
             docs/social-card.svg \
             docs/stats.json \
             docs/kev.svg \
+            index/releases/ \
             cves/
           if git diff --cached --quiet; then
             echo "No changes to commit"

.github/workflows/sync_collections.yml

@@ -2,7 +2,7 @@ name: Sync PoC Collections
 
 on:
   schedule:
-    - cron: '40 5 * * 4'
+    - cron: '40 */6 * * *'
   workflow_dispatch:
 
 permissions:
@@ -57,6 +57,8 @@ jobs:
             docs/kev.svg \
             index/cve_dates.json \
             index/cve_record_state.json \
+            index/collection_source_state.json \
+            index/releases/ \
             cves/
 
           if git diff --cached --quiet; then

.github/workflows/sync_cve_pocs.yml

@@ -39,6 +39,9 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Record published artifact releases
+        run: python3 scripts/releases.py --record
+
       - name: Refresh published counts
         run: |
           python3 .github/hero.py
@@ -57,11 +60,15 @@ jobs:
             index/reference_pocs.txt \
             index/cve_dates.json \
             index/cve_record_state.json \
+            index/github_discovery_state.json \
+            index/source_artifact_reviews.json \
+            index/source_artifact_candidates.json \
             README.md \
             docs/hero.svg \
             docs/social-card.svg \
             docs/stats.json \
             docs/kev.svg \
+            index/releases/ \
             cves/
 
           if git diff --cached --quiet; then

.github/workflows/sync_exploits.yml

@@ -53,6 +53,7 @@ jobs:
             docs/social-card.svg \
             docs/stats.json \
             docs/kev.svg \
+            index/releases/ \
             index/cve_dates.json \
             index/cve_record_state.json \
             cves/

.github/workflows/sync_metadata.yml

@@ -49,11 +49,22 @@ jobs:
       - name: Refresh CISA known-exploited status
         run: python3 scripts/audit_poc_links.py --kev-only
 
+      - name: Refresh reviewed reference PoCs
+        id: references
+        continue-on-error: true
+        timeout-minutes: 5
+        env:
+          GITHUB_TOKEN: ${{ github.token }}
+        run: python3 scripts/sync_reference_pocs.py --limit 40
+
       - name: Verify the generated index
         run: |
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Record published artifact releases
+        run: python3 scripts/releases.py --record
+
       - name: Refresh published counts
         run: |
           python3 .github/hero.py
@@ -66,6 +77,7 @@ jobs:
           git config user.email '[email protected]'
           git add -- \
             README.md \
+            index/releases/ \
             cves/ \
             docs/hero.svg \
             docs/social-card.svg \
@@ -76,7 +88,9 @@ jobs:
             index/github_advisories.json \
             index/kev.json \
             index/metadata/ \
-            index/references.txt
+            index/references.txt \
+            index/reference_poc_queue.json \
+            index/reference_poc_verified.json
 
           if git diff --cached --quiet; then
             echo "No changes to commit"
@@ -103,3 +117,7 @@ jobs:
         env:
           GH_TOKEN: ${{ github.token }}
         run: gh workflow run site.yml --ref main
+
+      - name: Report reference refresh failure
+        if: steps.references.outcome == 'failure'
+        run: exit 1

.github/workflows/sync_nuclei.yml

@@ -53,6 +53,7 @@ jobs:
             docs/social-card.svg \
             docs/stats.json \
             docs/kev.svg \
+            index/releases/ \
             index/cve_dates.json \
             index/cve_record_state.json \
             index/nuclei.json \

.github/workflows/sync_pocingithub.yml

@@ -44,6 +44,9 @@ jobs:
           python3 -m unittest discover -s tests
           python3 scripts/build_site.py
 
+      - name: Record published artifact releases
+        run: python3 scripts/releases.py --record
+
       - name: Refresh published counts
         run: |
           python3 .github/hero.py
@@ -63,6 +66,9 @@ jobs:
             index/github.txt \
             index/cve_dates.json \
             index/cve_record_state.json \
+            index/source_artifact_reviews.json \
+            index/source_artifact_candidates.json \
+            index/releases/ \
             cves/
 
           if git diff --cached --quiet; then