name: Sync CVE Metadata

on:
  schedule:
    - cron: '10 3 * * 1-6'
    - cron: '10 3 * * 0'
  workflow_dispatch:
    inputs:
      full:
        description: Rebuild NVD and the reviewed GitHub advisory cache
        required: false
        default: false
        type: boolean

permissions:
  contents: write
  actions: write

concurrency:
  group: repository-updates
  queue: max
  cancel-in-progress: false

jobs:
  sync:
    runs-on: ubuntu-latest
    timeout-minutes: 60
    steps:
      - name: Checkout repository
        uses: actions/checkout@v7
        with:
          ref: main

      - name: Set up Python
        uses: actions/setup-python@v7
        with:
          python-version: '3.13'

      - name: Pull CVSS, advisory and advisory PoC metadata
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: |
          if [ "${{ github.event.schedule }}" = "10 3 * * 0" ] || [ "${{ inputs.full }}" = "true" ]; then
            python3 scripts/sync_cve_metadata.py --full
          else
            python3 scripts/sync_cve_metadata.py
          fi

      - name: Refresh CISA known-exploited status
        run: python3 scripts/audit_poc_links.py --kev-only

      - name: Refresh reviewed reference PoCs
        id: references
        continue-on-error: true
        timeout-minutes: 5
        env:
          GITHUB_TOKEN: ${{ github.token }}
        run: python3 scripts/sync_reference_pocs.py --limit 40

      - name: Verify the generated index
        run: |
          python3 -m unittest discover -s tests
          python3 scripts/build_site.py --offline

      - name: Record published artifact releases
        run: python3 scripts/releases.py --record

      - name: Refresh published counts
        run: |
          python3 .github/hero.py
          python3 .github/getTrending.py --counts-only

      - name: Check for changes and commit
        id: commit
        run: |
          git config user.name 'CVE-BOT'
          git config user.email 'bot@pocindex.io'
          git add -- \
            README.md \
            index/releases/ \
            cves/ \
            docs/hero.svg \
            docs/social-card.svg \
            docs/stats.json \
            docs/kev.svg \
            index/cve_dates.json \
            index/cve_record_state.json \
            index/github_advisories.json \
            index/kev.json \
            index/metadata/ \
            index/references.txt \
            index/reference_poc_queue.json \
            index/reference_poc_verified.json

          if git diff --cached --quiet; then
            echo "No changes to commit"
            exit 0
          fi

          git commit -m "Sync CVE metadata $(date -u +'%Y-%m-%d')"

          for attempt in 1 2 3; do
            if git push origin HEAD:main; then
              echo "pushed=true" >> "$GITHUB_OUTPUT"
              exit 0
            fi
            echo "Push rejected; replaying onto the current main (attempt $attempt)"
            git fetch --unshallow origin main 2>/dev/null || git fetch origin main
            git rebase FETCH_HEAD || { git rebase --abort; exit 1; }
          done
          exit 1

      # Commits pushed with the workflow token raise no push event, so site.yml
      # would otherwise wait for its daily schedule. Dispatching is exempt.
      - name: Rebuild and deploy the site
        if: steps.commit.outputs.pushed == 'true'
        env:
          GH_TOKEN: ${{ github.token }}
        run: gh workflow run site.yml --ref main

      - name: Report reference refresh failure
        if: steps.references.outcome == 'failure'
        run: exit 1